The worst rules are the ones that don't let you use non-alphanumeric characters - and these are banking sites!