And then some sites throw salt in the wound by requiring "at least one special character that is not # or % or whatever" so if you turn on special chars for your password generator, you have to manually filter through it to pull out said characters.
Grinds my bloody gears.
What irritates me more is knowing that the people who implement those solutions are probably here. Shame on you, go back and fix it right now!
Login with your password. Site then responds that we emailed you a security code, but the security code expires in five minutes. Immediately below that, it notes that the email may take up to four minutes to send. From experience, I think the note about slow emails is accurate.
Who spent more than 30 seconds on that implementation thinking it was acceptable? Note that this is for a stupid intra-company fitness tracking thing (ie, I do not care at all about this data). Confirmation codes from my bank have a 30 minute window, but that is evidently too lax for step counting.
Now that whole site has the weirdest bugs. When I go to the mailbox, the site switches to some eastern european language. The things we do for cheap electronic components ...
Oh, of course they truncate also the password confirmation field.
'; DROP TABLE users; --
just for the lulz...