The tweeter (probably a non-technical support person, so go gently on him or her as an individual) has revised the statement:

"@passy I'm mistaken about the website security certificate but avoiding pasting of passwords is good practice & protects our customers 1/2" https://twitter.com/BritishGasHelp/status/463679554306203648

"@passy especially when using public computers. Alpha numerical policy ensures your protection without making special characters necessary^S" https://twitter.com/BritishGasHelp/status/463681274092462080