I'm bored with the brute force attack prevention argument.  Why not just help your users out by throttling requests after N attempts?<p>With throttling, "strong" password requirements (non-alpha, etc.) serve only to force users not to pick passwords obvious to someone who might know them (wife's name, etc.).  That and avoiding the "letmein" cases, I guess.