Your passwords don't suck, it's your policies

eGuy writes: "ZDNet sparked a debate about password policies when John Fontana wrote about my open source (LGPL) password policy project that rewards XKCD-like passwords. Steve Watts of SecurEnvoy replies that it is too little, too late. What better place to debate it than Slashdot? (And shamelessly plug my OSS pet ;) What think ye? Is there hope for passwords?"