New hacking methods make short passwords unsafe, but Microsoft makes it tough to go long. Her's how to forge an effective policy. It's time to raise the bar on minimum password length requirements.