What I hate is the impression. You can have mitigation controls galore. I trust that they all do. However, it's difficult for average customers to understand th

What I hate is the impression. You can have mitigation controls galore. I trust that they all do. However, it's difficult for average customers to understand that. When even NIST has longer password recommendations, people who hear that "long passwords are safer" should have that option. Banks are relatively arbitrarily depriving security conscious people of that nominal opportunity to try to practice good password hygiene. The line is that password resets increase with password length. I'd be fine with that. I am an Information Security professional, customer of financial institutions, and started my earliest engineering career for a large bank.