Currently, two methods require 8 characters, the 8 being hardcoded
- Registrar::validator(), previously at 6, at 8 since 8c71a3c1bd2e
- ResetPasswords::getResetValidationRules(), previously without specific requirement, now synced with the other since 0e1390e52d05