Worst password #security encounter so far is with @Allstate. Max 10 chars (!), forced complexity, and doesn't work @1Password. Super lame.