Dumb Password Rules

Commonwealth Securities (Commsec) is facing criticism from security-conscious users for capping password length and blocking pasting into its login field, which makes password managers difficult to use. Commenters say short password limits and anti-paste rules are outdated practices that push customers toward weaker, reused passwords, and they are calling on the brokerage to modernise its authentication requirements.

Security enthusiasts are calling out Mindware over its password requirements, which reportedly allow special characters but only a select, unspecified subset of them. The complaint, circulating in cybersecurity circles, argues that failing to tell users which symbols are permitted makes it needlessly hard to create valid, secure passwords, turning a basic usability issue into a running example of poorly designed password policies.

ADP, the US payroll and HR services giant, is being mocked online for its first-login password policy, which forces new users to change their password immediately. Critics say the enforcement message is poorly written and the rule itself adds friction without improving security. The complaint has been logged on a site that catalogues bad password requirements at major companies, drawing agreement from security professionals who argue such forced resets often push users toward weaker, predictable passwords.

WeatherBug is being criticised for capping account passwords at 16 characters, a restriction catalogued on a site that collects poor password policies. Security-minded users point out that short maximum lengths discourage long passphrases and can signal outdated or unsafe password handling behind the scenes.

Security-conscious users are mocking Rushmore Loan Management Services for a password policy that rejects single and double quote characters. Poorly designed password restrictions are a recurring target of ridicule among information security professionals, who argue arbitrary character bans suggest bad handling of user input and weaker overall security practices.

MetLife is being criticised online for requiring account passwords of no more than 20 characters, banning special characters, and blocking pasting into its password confirmation field. Security commentators say such rules push users toward weaker passwords and discourage password managers, running contrary to widely accepted guidance from standards bodies like NIST.