Password policies aim to prevent poor password choices by regular users and typically specify a password must be >=8 characters in length. However, password crackers such as Ophcrack and Rainbowcrack use rainbow tables and as such are very fast. Given the rainbow tables that are available for purchase today (see http://projectrainbowcrack.com/table.htm ), what would be a more prudent password policy?