How is this for Gobbledygook? Your home banking access code is expired! You must change your access code at this time. Your access code:

* may be between 4 and 20 characters in length
* must not have been changed within the last 0 days
* may not be one of 3 previously used access codes
* must not repeat the same character more than 0 times
* must not contain 0 characters from previous access code
* must contain at least 0 non-alphabetic character(s)
* may contain the following special characters: !”#$%&()+,-/;<=>?[\]^_`{|}*’
* must contain at least 0 alphabetic character(s)

1) What does “must not have been changed within the last 0 days” mean?
2) How about “must not repeat the same character more than 0 times” ?
3) Or “must not contain 0 characters from previous access code” ?

This kind of stuff is what makes people think computer programmers are crazy. I am sure the software allows users to set criteria. Then this screen is suppose to explain the criteria to users. It seems to me, if the selection is 0, then the correct procedure is to not display anything about it to the user.

Really I am not sure how “must not contain 0 characters from previous access code” is even to be applied if an positive integer were used. I guess you could not allow using any characters from the last access code, which seems crazy to me to begin with, but setting a number seems totally bizarre. I could see setting a requirement that says no repeat of the same sequence of x characters. I think that would probably not work well, but at least I understand what it would mean.

Related: Change Your Name - Bad Software Visual Controls - Complicating Simplicity - web usability resources - Schneier on Security