There are so many fails when it comes to signup/password change/logon UI that I’ve become acutely aware of after sitting next to an elderly couple trying to imp

There are so many fails when it comes to signup/password change/logon UI that I’ve become acutely aware of after sitting next to an elderly couple trying to implement 1password. Validate that your passwords match immediately, yes, but be aware that the password fields may be filled in / altered by a process other than typing a character! How do you describe to a non tech user that the only reason the new password and confirm password fields are actually the same (even though there’s an error) and to proceed your only option is to hit space bar in one of those fields and blindly delete it. Then it updates the validation and you can proceed? Along the same lines- sites that don’t let you paste in your password from a password manager. What’s worse - not letting you paste in only to “confirm” your password. What’s the point of that? Just finding the account page to change your password is super confusing. There’s typically a little user icon in the top right so I have shown them that. But after that, sometimes it’s in “profile” - other times “security” - and other times it’s hidden under a few levels of menus. Some sites call the password a “passcode” - and on and on. Password complexity requirements have gotten out of hand. “At least one symbol but not more than four, two of which can repeat - and only the symbols @ and ! Allowed”. Really?? Now I have to specially tweak the password automatically generated by 1password to match. Again, explain that to your grandma. SMS/2fa prompts using a password field - whenever you fill one in, it prompts 1password to helpfully remember that password for you. Super confusing for a non tech person! Now they’re potentially adding a ton of new “passwords” for this website into the password manager, and they have no idea which one to use when logging in again. Email “validation” - I gave up using my personal non gmail address for sites as most of them claim that the non standard tld I used was not “valid”.