Depends what you mean by "legit". I once asked a project manager if the client had and legally-mandated rules for passwords. The response from the client was (paraphrased) "no legal requirement. Let's go with 6-12 characters, at least one number and one symbol". I suggested a higher (or no) upper limit, but I was told to just give them what they wanted.
"It's what the client wants" is a rather legit reason, whether the rules come from a legal standard for their industry or completely out of their rear end.
Comments
Depends what you mean by "legit". I once asked a project manager if the client had and legally-mandated rules for passwords. The response from the client was (paraphrased) "no legal requirement. Let's go with 6-12 characters, at least one number and one symbol". I suggested a higher (or no) upper limit, but I was told to just give them what they wanted.
"It's what the client wants" is a rather legit reason, whether the rules come from a legal standard for their industry or completely out of their rear end.