Dumb Password Rules

ADP, the US payroll and HR services giant, is being mocked online for its first-login password policy, which forces new users to change their password immediately. Critics say the enforcement message is poorly written and the rule itself adds friction without improving security. The complaint has been logged on a site that catalogues bad password requirements at major companies, drawing agreement from security professionals who argue such forced resets often push users toward weaker, predictable passwords.

WeatherBug is being criticised for capping account passwords at 16 characters, a restriction catalogued on a site that collects poor password policies. Security-minded users point out that short maximum lengths discourage long passphrases and can signal outdated or unsafe password handling behind the scenes.

Security-conscious users are mocking Rushmore Loan Management Services for a password policy that rejects single and double quote characters. Poorly designed password restrictions are a recurring target of ridicule among information security professionals, who argue arbitrary character bans suggest bad handling of user input and weaker overall security practices.

MetLife is being criticised online for requiring account passwords of no more than 20 characters, banning special characters, and blocking pasting into its password confirmation field. Security commentators say such rules push users toward weaker passwords and discourage password managers, running contrary to widely accepted guidance from standards bodies like NIST.

PCPartPicker has been flagged in cybersecurity discussions for allowing passwords of any length and complexity, including single-character passwords, with no confirmation emails sent on password changes. Security-minded users argue the lack of minimum requirements leaves accounts unnecessarily vulnerable to trivially weak credentials, and the site has been added to a running catalogue of questionable password policies.