Fidelity had a similarly terrible password policy (6-12 characters, only letters and numbers). I complaining to their tech six months ago and got a stock "we're looking into it" answer. In the past month they've actually fixed the issue and now require 6 characters (upper case, lower case, number and symbol).