"What should service providers do?": https://tomssl.com/2016/10/21/a-sensible-password-strategy/ https://tomssl.com/2016/10/21/a-sensible-password-strategy/ Th

"What should service providers do?": https://tomssl.com/2016/10/21/a-sensible-password-strategy/ https://tomssl.com/2016/10/21/a-sensible-password-strategy/ This is a pretty straightforward set of expectations which should solve most issues.