The hypothetical of a manager asking for the feature by the next day is pretty accurate. Besides that, it might be a product or design person that thinks the r

The hypothetical of a manager asking for the feature by the next day is pretty accurate. Besides that, it might be a product or design person that thinks the requirements would clash with the current product/design and don't want to go through another iteration. A better answer to the problem is to not have password requirements because it's the user's responsibility to choose a secure password. If their password is compromised because it was their dog's name or "password1234" then it's their fault. A way to engineer against brute-force hacking is to limit the number of attempted logins per username and IP. If they hit the limit then their account should be locked or their password should be automatically be reset with an email.