Why not let the administrator decide?

Why not let the administrator decide?

If you're trying to make passwords secure, you end up needing an entropy estimate in order to be able to detect users who are lying to you - they claim to use a password generator, but do things like "tweak" the generated password to be more memorable (so they change "swxjzdap", which is generated by an 8 character, 26 choices per character ⇒ 37 bits entropy, to "sexizdad" for memorability).

Note that a minimum length is a weak entropy estimate - you know that written text has an entropy around 1 bit per character in most alphabetical languages, so you know that a minimum length of 10 characters is going to be 10 or more bits of entropy.

Ultimately, though, while it's fun to think about how to make passwords secure, we already know how to do far better - key based authentication (like SSH keys) means that you've got as many bits as you want for the authenticate to a system approach (a 256 bit ECDSA SSH key is equivalent to a 10 word Diceware passphrase, or 22 characters of random case-sensitive letters and numbers), and you can have a master key backed by a hardware token to give you 2FA for unlocking access to your keys (with, again, the large number of bits a key can have).

Note: you can avoid this step in the future by logging into your LWN account.