The man behind annoying password requirements admits he got it wrong

Those annoying password requirements like "must have at least one special character?" They do more harm than good.