... Well... yes... it is brain dead.

I've had people fail the password reset page... Apparently chrome just autofills whatever it wants and doesn't care about websites that say NOT to autofill a field unless you declare it in some magic way that is non-standard. And our users will get a temporary password in email to let them back into the service to do a proper password reset... They'll fail the reset because chrome autofills their old password and they're too dumb to paste in their temp password from the email. Now the message there is a bit more vague... something like "Please check all inputs. No changes have been made." But I've literally watched users on screenshare complain that "No, I put the password there! See the dots are in the box!".... No... your browser put your old password there because that's what it knows. You need to put the temporary one there... See the words to the right of the field that say "TEMPORARY PASSWORD"? That's where you put it.

The infuriating part is sales and support staff that are on the user's side and make requests to devs to change it... There's reasons that we've only ever had one security event in 22 years... 1) we're lucky... 2) these rules matter.

Users are indeed dumb. Especially the 10-20% of them that hog up 80% of your support staff.

Addendum: Oh! Our users (companies) can create sub-users (workers)! So they can invite others to do stuff on their behalf/in their account. We have support staff ask us constantly to reset those sub-user accounts... Big NO. I don't know that user and can't validate that user. I will not be accidentally granting someone sensitive information to another person's information. You can contact the person who gave you the account access and tell them to reset your information.... make sure you enter the temp password and not your old password in the reset form... otherwise I'll be talking to you again in about 15 minutes.