It's not wrong to use. Its wrong to codify it or enact it as policy because what a corporate security goons published "password requirements" is really just "search space reducers" For example; not wasting my time on guesses below the 8 char minimum. Thanks security guy, that saved a BUNCH of time!