The function as I initially suggested it allows admins to decide whether or not they want to enforce the use of uppercase letters and numerals. If we're going to add special characters as a third optional element, it doesn't make sense to argue that the list of available special characters must be indefinitely large. (In other words, if you're going to argue against allowing the admin to restrict the list of special characters, why aren't you also arguing against the checkboxes?)
I don't think it's the place of the software to decide how strong the end user's passwords should be. The software merely has to give the admins the tools they need to enforce the policies they decide on.
If we're going to require users to include special characters, then we should tell them which characters are required, or run the risk of frustrating them. For example, I've frequently had the experience of trying to register with a site that requires the use of special characters but won't say which ones are allowed. After having my password rejected a few times, I simply gave up and went away. And on one memorable occasion, I used a special character that was interpreted as a delimiter, with the result that my password was truncated and ended up being much shorter than I thought it was.
So at the very least, if the software isn't going to tell users which characters they can use, it should at least let them know which ones they can't use. Anyhow, I'm sure Toby and Franz will come with an elegant and rational implementation.
