I saw a recent password question on security.stackexchange "[Is the NHS wrong about passwords?](http://security.stackexchange.com/questions/138996/is-the-nhs-wrong-about-passwords)" The question is very specific about one organization but from what I've seen the same "known bad" password policies are used in most big organizations.

When I say "known bad password policies", I mean to say most big organizations focus on relatively short (8 to 14 characters) passwords with a focus on requiring minimum number of special characters (upper/lower case, symbols, numbers, etc).

When I say "big organizations", I am not just referring to commercial but non-commercial (i.e. NIST's for example. i'm sure others can come up with other such examples). Now that I think of it ... most linux distros have some sort of default password policy that also is very similar (relatively short passwords but requiring special characters).

**Why do the large majority of big organizations have "known bad" password policies?**