Security Consistency: Should we standardize password requirements?

I saw a presentation earlier this week where a researcher was talking about consumer education with respect to security.  The researcher said that one way to make security education more consistent would be for websites to all have consistent requirements around passwords.  For example, all websites should require that passwords have at least 8 characters and should include on capital letter, one digit, and one punctuation mark.

While I am all for having consistent messaging around security practices and even encouraging users to have secure passwords, I worry about the implications.

Imagine a world where every website had the exact same requirements for passwords.  Even if the passwords were secure, the risk is allowing people to have the same password on every website.  In this case, if the bad actors were able to phish the password for one of my accounts, and they had my email address, they would likely be able to access many of my accounts.

To make matters worse, once the bad actor has the password for one of my accounts, they will be able to login to my email account which will let them do a forgot my password function on almost any other account.

While I applaud researchers for thinking of ways to make security education more consistent, making password requirements consistent has more negative ramifications than benefits.