All this time I thought they were using an amazing heuristic to infer password requirements from the page