Password rules often happen because a customer who had a lot of money told somebody who wanted that money that they wanted these specific password rules. "Oh,

Password rules often happen because a customer who had a lot of money told somebody who wanted that money that they wanted these specific password rules. "Oh, you require us to implement these stupid password rules you came up with, in order for us to get your 20 million dollars? We'll have it implemented by end of the week." And this is also why those rules never seem to change, or only get worse. Nobody remembers when or why those rules were implemented, and nobody is going to risk potential business just to make passwords easier to use or more secure. Product security is always second to short-term gains and job security.