I am implementing a system where I need to store passwords in a database (hashed and all). My issue is that the business side requires me to not enforce any constraint on them except length (8 characters minimum), but highly advise to use special characters, uppercase characters or not use your first name. Not following these advises would have liability implications on our side. For example, we would allow a client to use
12345678 as a password, but would not be liable if it gets brute forced. This would require me to have an integer in my database that remembers this for the original password (pre-hashing). Any big no-no in doing this ?
EDIT: Just to clarify, the integer would most-likely be a flag that represent the type of weakness, ie: too simple, commonly known weak password, uses personal information, etc..
EDIT 2: Current solution based on the multiple answers and comments below would be to store an integer with flags that have been bit shifted. This integer would be stored in a separate database and encrypted using public-key cryptography, most likely using ECC.
EDIT 3: This is only viable assuming basic security at lower levels (OS and network) as well as spam prevention. The system would block further attempts for sometimes after multiple failed attempts, password are securely hashed using both a (at least) 128 bits salt and time/memory consuming algorithm (Argon2id in this case).
Final Edit: I have set @steffen-ullrich response as accepted. Lots of very good answers and I appreciate all the reason why I shouldn't do this but I wanted answers on what could go wrong and how one would go about doing it this way (many responses helped form the last edit). The legal aspect was provided to focus on the technical standpoint in light of a requirement I have no control over. My second edit basically describe what implementation would be a 0 compromise way of doing this. Disclaimer: this is pure curiosity and I have no plans to actually deploy this in production for the time being, I would recommend reading comments and chat threads before attempting this as they describe much of the problems and limitations of an approach like this.