I just tried to add some details to a bug I have reported at bugzilla.mozilla.org (BMO) but wasn't let in because my password had been nullified. Now they want me to create a new password meeting certain requirements, listed here
https://wiki.mozilla.org/BMO/UserGuide/Passwords
must be at least 12 characters in length
must not contain parts of your email address, or your real name
must be complex, which means:
must be a passphrase of at least four words
OR
must contain a mixture of letters and symbols, containing characters from 3 out of the following 4 character classes:
lowercase letters, uppercase letters, numbers, and other symbols
I decided to not update my password, and, as a consequence, stop using their service/provide BMO with bug reports, because the password they require won't be easy to memorise and I think this is unnecessary complex for a bug reporting service. My current password is 9 characters, contains upper- and lowercase letter, numbers as well as special characters. That is complex enough for my purpose.
So my question is: are there any objective reasons for such a complex password for something like BMO? What is the worst thing that can happen if someone cracks an outside users password there?
Finally some personal remarks about this issue: personally I am not too found of the thought of a password manager in the cloud (which is was BMO recommends). That type of single-point-of-failure is, IMHO, problematic. Even if CIA/NSA or similar might not target me specifically, they most likely might target someone else using the same service and if they manage to break it, all my secrets come as a free bonus for them.
Storing sensitive data locally and have good backup solution seems much safer for the occasional hacking attempt from a jealous partner or someone trying to commit credit card fraud (if some state sponsored agency targets me specifically I am screwed anyway, either by using a secret subpoena, technically circumvent my protection or simply threat me with a big enough stick).