This. There&#x27;s nothing like setting up a rigid password policy to give the <i>appearance</i> of security, then providing a secondary super weak password like ssn or easy to figure out security questions. For many sites its purely about appearance with little real thought given to protecting users.