The worst is when some forms set rules but prevent the user from pasting a string into the duplicate field for verification. If this is meant to prevent user er

The worst is when some forms set rules but prevent the user from pasting a string into the duplicate field for verification. If this is meant to prevent user error in case of a typo in the first field, then it also thwarts many of us using password managers. Somehow my browser can auto-generate and enter a password, but I can’t. That’s a work-around, but it’s irksome anyway. On another note, a more constructive metric for password security on a basic website account would be to set a complexity standard that allows multiple ways to get there. A haiku of approximately 60 plain characters, for example, should be as secure as a 30 character alphanumeric string, at least when it comes to brute forcing. It seems to me like plenty of weak passwords could be created to eke out the minimum requirements for a lot of sites, so this standard lends a false sense of security, especially when any password is recycled.