> "The only reason to have those two rules is because you are storing the password in plain text so anyone who gets access to the database can read them freely.

> "The only reason to have those two rules is because you are storing the password in plain text so anyone who gets access to the database can read them freely." That is certainly not the only reason to have those rules; in fact, it's probably one of the least popular reasons. It's done to keep customers creating short-ish passwords, which are likely to be more memorable, and therefore reduce the support load for password resets. Whether this is actually effective or not is another thing entirely.