The guy who came up with the criteria for "strong passwords" has come out saying he strongly regrets it. The only thing they really protect against is brute force attacks, which aren't really a thing anymore. All they really do now is make it harder for people to remember their passwords.