How I Collect Passwords 
I have to say that I loved his other post on the TSA's ridiculous password policy...<p><a href="http://xato.net/passwords/worst-password-policy-ever" rel="nofollow">http://xato.net/passwords/worst-password-policy-ever</a><p>Their policy is:<p>1. Minimum password length is eight characters.<p>2. Passwords must contain at least one of each of the following: one alphabetic uppercase, one alphabetic lowercase, one numeric, and one special character.<p>3. Passwords shall not contain any two identical consecutive characters (example: 22apples, 14588904).<p>4. Passwords may contain no more than two identical consecutive characters in any position from the previous password.<p>5. Passwords shall not contain any dictionary word.<p>6. Passwords shall not contain any proper noun or the name of any person, pet, child, or fictional character.<p>7. Passwords shall not contain any employee serial number, Social Security number, birth date, phone number, or any information that could be readily guessed about the creator of the password.<p>8. Passwords shall not contain any simple pattern of letters or numbers, such as "qwerty" or "xyz123".<p>9. Passwords shall not be any word, noun, or name spelled backwards or appended with a single digit or with a two-digit "year" string, such as 98xyz123.<p>10. Pass phrases, if used in addition to or instead of passwords, should follow these same guidelines.<p>11. Passwords shall not be the same as the User<p>12. Password length will be selected to provide a level of protection commensurate to the value or sensitivity of the resources or data it protects, but not less than eight characters.<p>You just can't make this stuff up!