This. There's nothing like setting up a rigid password policy to give the appearance of security, then providing a secondary super weak password like ssn or eas

This. There's nothing like setting up a rigid password policy to give the appearance of security, then providing a secondary super weak password like ssn or easy to figure out security questions. For many sites its purely about appearance with little real thought given to protecting users.