This isn't such a bad thing. If this standard were ubiquitous, Troy Hunt could maintain a top-1000 list of easiest-to-brute-force websites according to their pa

This isn't such a bad thing. If this standard were ubiquitous, Troy Hunt could maintain a top-1000 list of easiest-to-brute-force websites according to their password-requirement declarations. One might present one's own top ranking to one's CTO to help start a conversation about eliminating voodoo security practices. Hopefully the Top-1000 page would include an intro why the list should be empty.