Best rules I ever lived under were “We’re continuously running JTR against all users, and your password can be anything it’s unable to crack.”