Enforcing arbitrary password rules. "Must contain at least two '$' characters", "Cannot contain more than one '?'", etc.
However, I think being able to use the same stupid password on all sites I do not care about is a feature rather than a bug.
However, I think being able to use the same stupid password on all sites I do not care about is a feature rather than a bug.
I had a "stupid" multiply re-used password exposed in a breach of PerlMonks (which I didn't really care about in 2007 or so) which I also used when signing up to check out yet another new social media site in 2008. A couple of years later my Twitter account was sending Acai berry spam to my friends...
(And even if new-site-de-jour doesn't turn out to be something you stick with, it's now got your name (or regular handle) with the risk of damaging your reputation when it gets exploited without you even knowing...)
Yeah, I mean, my friends talked me into signing up for some stupid site back in 2005, "Face"-something? Seemed pretty trivial to me.
(IIRC in all seriousness Facebook's password requirements were hilariously trivial back when they first started.)
Thinking about it, my account was added by a company using Azure, perhaps they are able to set the password restrictions for their sub-accounts...