Except it is always a magnitude easier to register a new account than to hunt down for an existing one. Conversion is way too low. > Accounts with bad password

Except it is always a magnitude easier to register a new account than to hunt down for an existing one. Conversion is way too low. > Accounts with bad passwords get compromised, spam, then banned Just like any other account with a proper good password (10 char, 3/4? Certain e-gov site recently forced me for a 12-char, 4/4 without any 3 chars of the sitename in a row) on a proper good one-time/one-use email address... which was compromised by a malware running on the user's machine. Forcing a stupid password policies only increases the friction for a new (and sometimes existing) users, while not providing a meaningful increase in 'non-compromising'.