Hey Box frontend developers,

Your half-baked implementation of a password strength checker (e.g., zxcvbn or a custom regex), and then tying it to events like keyup, keydown, or input prevents users from using password managers. So now I'm using a really simple password that I can hand-type because you disallow pasting and (poorly) implement live re-validation.

Congrats, your site is now less secure.