Were these regulations created at a time when brute force password cracking was a legitimate concern?<p>Password policies do definitely raise the entropy of the passwords, so if the attack vector you&#x27;re concerned about is entropy sensitive, its a decent strategy.<p>As someone who has had to enforce such password policies many times, I can say that it&#x27;s almost always because of some regulatory or certification organization that requires complex policies.