Not only this, but they also have a sadistic trait against their users. My password on another site (a bank too, IIRC) requires the password not to have my emai

Not only this, but they also have a sadistic trait against their users. My password on another site (a bank too, IIRC) requires the password not to have my email username and consecutive, or repeated letters. My email username is "u" (as is u@example.com) and I usually generate a 50 or 70 characters long password. There is usually a "u" (they check the case, too). And come characters are repeated in the whole password. So I reduce the length, significantly, sometimes to 8 characters. The people who make rules in security in some areas are complete idiots.