So essentially you are saying you are happy for your users to use any of the passwords from any top known password lists, such as rockyou etc, based upon;
A. fear the dilution of the potential pool
B. Imposed a min&max limit of 8 characters
C. storage requirements
Most organisations typically use Windows, thus the central authentication is with active directory, If you dump the users out, the hashes are not salted.
Increasing the character set does help increase the potential pool thus addresses one of your concerns as would increasing the minimum limit.
Setting a maximum limit is counter productive, that said there are upper limits of 254 characters on Windows before any issues, anything longer won't allow logon (Can be set within AD, however the clients Gina seems to trim thus can never match the hash).
For point C. the storage requirements can be solved by not building the pre-computed rainbow table as a banned list and inverting the logic used to build it to run at the expense of CPU as and when users reset credentials. Thus you can use a smaller dictionary (currently have one at 80k words 915kb).
Complexity rules are bad when users try to use that complexity as a substitution mechanism to attain shorter 'P4$£w0rds' vs 'My long and strong phrase' which has 2 of the complexity rules with space being valid but not classified in any of the character sets is surprising, but just hash tagging the phrase and even if the attacker knew this would still be too expensive for them at 26 characters ^(54).
I have a working solution that only took a few weeks research and development which is running in production environments for last few years without problems.
This is saving the team many hours each year from dumping the hashes and cracking them, to audit for weak passwords that users whom have had training are still setting because they could.
These functions can be translated to other platforms (Azure now has the capability).
Hence my original post, and so far it's looking like a perception issue.
Thank you for your comment and everyone else who is contributing.
