Probably you’ve already heard about this vicious circle thousand times:
NIST, password management, Password policy, Security, The National Institute of Standards and Technology