Parse, don't validate (2019)

This post resonates with a lesson I’ve learned in my career so far: It is always easier to relax constraints than tighten them.

What you say makes theoretical sense, but many bank systems still enforce weak password constraints because someone enforced those weak constraints 30 years ago in mainframe code that nobody seems to want to update.