Hacker vs. cracker. Hack isn’t a nefarious term, or at least it shouldn’t be. Hacking is just using something in an unintended way. The problem is with how DMCA made that am illegal thing to do if there was a digital lock. While intended to mean you can’t bypass CSS to rip movies from DVDs, it’s been used to block the right to repair and other things completely anti-consumer. But you probably know this.
Someone on Reddit once thought I was a bot because I use proper grammar. 12 years of comment history would have demonstrated otherwise, but it wasn’t a battle worth fighting.
That’s one way it is weaker, but moreso because it reduces the entropy. If a user can provide a password which uses 26 letters, upper and lowercase, 10 numbers, and an unrestricted set of symbols, but for the sake of argument we’ll say 10, then there are a lot of possible combinations. If you are limited to only 12 possible at max, it is 46^12. Now you impose an artificial requirement that it is one of each, then it actually weakens that further by making the hacker know that there is one of each in there so it is 2626101046^8. Or roughly 910^19 vs. 1.3610^18. I personally try to use passwords which are between 16-20 characters long, or roughly 2*10^33. By restricting the total number of characters and forcing specific combinations, then the password is less cryptographically sound.
Using this calculator, https://bitwarden.com/password-strength/, it is a difference of 3 hours vs. centuries using the bank’s mandate vs. only lowercase and 20 characters.
Edit: Something seemed off about the math. Should have multiplied instead of added, but still less sound secure because there are imposed requirements. The biggest issue is that there is an upper limit of 12 characters.
As a general rule of precaution, don’t follow links in the email. Instead go to the website directly, maybe from a private or incognito instance, and reset it directly. If the email is valid, you’re doing the same thing and if it wasn’t you aren’t drawing attention to anyone else.
When does something become an OS feature and when is it an add-on? Consider the use case. If you need to make a backup or restore data from one, by having this as part of the OS it is always available. It’s line having vi installed; it comes with every Linux distro, but a lot of folks use Emacs. It makes sense that this should be a system component.