I don't know Mr. Shi, but I might make a similar comment. Allow me to explain why I think this is reasonable from my context of having spent more than a decade

I don't know Mr. Shi, but I might make a similar comment. Allow me to explain why I think this is reasonable from my context of having spent more than a decade working in the China IT community. There are many differences between a China Internet company and a U.S. one. One big difference is how heavily their leadership is weighted outside of the tech inner workings of the company. A second problem is the maturity of IT process management. Most Chinese programmers are serfs; lowly paid and no real voice. Managing the many security processes that a solid Internet site should be leveraging is several "business generations" away here in China. Solving this one problem of storing passwords and handling auth correctly is attainable in the short term compared to the rest. The good news is the problem has already been solved and refined. In this context, it is not unreasonable requiring Internet sites that handle user auth to follow a very clean set of rules.