Oh, man that's bad. The worst I've come across in the wild was some bank or financial institution (don't remember which one) which did some "sensible" validatio

Oh, man that's bad. The worst I've come across in the wild was some bank or financial institution (don't remember which one) which did some "sensible" validation at creation time. I.e., your first phone number had to look like a phone number, your mother's birth date had to be a real date, etc. That was pretty bad but you could still choose the phone number one and get a reasonably decent password. This is way worse.