Arbitrary password rules don't make phishing any easier or harder. For phishing involving malicious websites the answer is not training, it's U2F. For other ph

Arbitrary password rules don't make phishing any easier or harder. For phishing involving malicious websites the answer is not training, it's U2F. For other phishing, yes, training is useful.