Context is that I had to register for a lot of accounts recently and some of the rules really make no sense.
Not name-and-shaming, but the best one I’ve seen recently is I might have accidentally performed an XSS attack on a career portal using a 40-digit randomly generated password…
The oddest I’ve ever encountered: EXACTLY 15 characters long. No more, no fewer. 15.
Honorable mention: Various online accounts where I used my password manager to generate a long, secure password, which the website accepted without warning or error. I was then locked out because their user management system could not handle such long passwords (had to create a second account with a much shorter password to find that out) 🤣
A university I worked at had a similar policy to the first one.
They wanted a single username and sign on across all IT systems but also had some really old legacy systems that didn’t support long passwords.
So they’d force everyone to use passwords that were exactly as long as the maximum legacy password length.
For me, the worst system is the Microsoft authenticator which locks me out my account for five minutes if my fingerprint doesn’t match the first time I try.
The first one is absurd. The second one is straight up messed up.