I used to just tack on Aa$0 to the end of all my (already good) passwords to satisfy these idiotic rules. Until one website decided that '0' was not a number, and then I had to change everything to Aa$1.

I tend to revolt against this kind of bullshit by creating terrifyingly primitive, pathetic passwords, and flagrantly sharing what my password is, in front of relevant admins, while complaining loudly about the concept of "character diversity," as a way of fomenting popular rebellion.

When I'm met with periodic expiration, I employ constant direct password assistance as a means of unpopular two-factor authentication, to piss people off, and stir the pot.

I then fail my password reset as many times as necessary to recover my preferred password for that system, to enforce to freedom of password selection.

I control my password. Me.

Not you. Me.

Im glad Im not the only one that does this.

Until a website thinks a 1 is an lower case L, and you have the same problem all over again.

But it cannot include ",',$,;,<,space,etc.. because or engineers are still not 100% confident in our input sanitization.

And you can be like HSBC which along with not accepting special characters, also saves and validates your password only in lowercase

And Citibank internet banking passwords are case-insensitive. (Atleast I can vouch for Citibank India)

Facebook passwords are also case-interchangable. i.e. PasswoRd5 is same aa pASSWOrD5 both will work. Idea is if Caps lock is left ON by mistake.

You'd be surprised how many websites won't accept SELECT or DROP as valid usernames.

"It also needs to be changed every 60 days and cannot be the same as one previously used in the past year."

(Promptly changes around variables in quadratic equation for the umpteenth time, leaves the rest of the password the same.)

This is precisely why I don't use ubNUTu.