The same banks that typically embrace the 3 biggest signs of security stupidity:

- max length of passwords (not talking about lengths that would pose a DoS threat, talking limits like 20 characters)

- incredibly constrained character set for passwords (“your password can’t contain a quotation mark, only alphanumeric and these specific 10 punctuation marks”)

- “security” questions (can we just ban these already? Knowing that my childhood dog’s name was Bingo should NOT give you the ability to change my brokerage password.)