New comment on reddit

As a counterpoint, Troy Hunt recently posted this: https://www.troyhunt.com/banks-arbitrary-password-restrictions-and-why-they-dont-matter/

An interesting quote from the post:

Password Limits on Banks Don't Matter

That very first tweet touched on the first reason why it doesn't matter: banks aggressively lock out accounts being brute forced. They have to because there's money at stake and once you have a financial motivator, the value of an account takeover goes up and consequently, so does the incentive to have a red hot go at it. Yes, a 5-digit PIN only gives you 100k attempts, but you're only allowed two mistakes.