If you are going to object to a password, be more specific about the objection. Merely saying it is "weak" is not much of a hint. Also, the rules for a "weak" 7 character password should be different than those for a 14 character password. How about rules that are different for 8 characters vs. 16 vs. 24, etc? You could alter the algorithm such that the entropy of the character set decreases each time you misuse a character. Thus a password that uses the word "password" could be penalized by eliminating all the characters used in the word "password". Thus the character set decreases by 7 unique characters. Eliminating a 'p', 's', 'w', 'o', 'r' and 'd' from the character set is a better reflection of entropy than eliminating long, long passwords altogether. A better way to identify a weak password is not by penalizing individual violations, but by penalizing violations of the characters themselves.
If you are going to object to a password, be more specific about the objection. Merely saying it is "weak" is not much of a hint. Also, the rules for a "weak" 7 character password should be different than those for a 14 character password. How about rules that are different for 8 characters vs. 16 vs. 24, etc? You could alter the algorithm such that the entropy of the character set decreases each time you misuse a character. Thus a password that uses the word "password" could be penalized by eliminating all the characters used in the word "password". Thus the character set decreases by 7 unique characters. Eliminating a 'p', 's', 'w', 'o', 'r' and 'd' from the character set is a better reflection of entropy than eliminating long, long passwords altogether. A better way to identify a weak password is not by penalizing individual violations, but by penalizing violations of the characters themselves.