They are still trying to justify with
"we took independent advice on the password format and it was recommended to use between 6-8 characters" (Aug 2015)<p><a href="https://twitter.com/nsandihelp/status/632290575962738688" rel="nofollow">https://twitter.com/nsandihelp/status/632290575962738688</a>