I think one of the worst things is the sites that think they are being "more secure" by adding extra rules for passwords beyond the typical. If people want to use the same password for everything -- or maybe better, use one password for the really important stuff and another password for everything else -- you really shouldn't try to fight against that be requiring at least one capital letter and at least one number and at least one symbol (or whatever).
Another obnoxious thing is sites that, when you change your password, don't let you use one you've used in the last X months.
In both these cases, what happens is that you defeat people's attempts to make their passwords adhere to some system they can remember. And then they just says "f*ck it" and do really easy to guess passwords.
Another obnoxious thing is sites that, when you change your password, don't let you use one you've used in the last X months.
In both these cases, what happens is that you defeat people's attempts to make their passwords adhere to some system they can remember. And then they just says "f*ck it" and do really easy to guess passwords.