Real security researchers know that requiring symbols and upper case letters actually reduces security. Those requirements are explicitly rejected by the latest

Real security researchers know that requiring symbols and upper case letters actually reduces security. Those requirements are explicitly rejected by the latest NIST recommendations: https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html So I'm basically agreeing with you, that a lot of people "in security" are just cargo culting.