Interestingly, one of the studies they cite finds that blocking common passwords is one of the most frustrating experiences for users. Even though it's more secure, the user has no idea what's wrong with their password or how to correct it.
> one of the most frustrating experiences
I understand this frustration as a mismatch between the user's non-expectation of security and the service's obeyance to industry security best practices.
Placing a cognitive burden of memorizing a new password just to try out your product strikes me as cruel.
Maybe only enforce password rules as progressive enhancement once sensitive information comes into play? After all, what's the point of protecting junk?
Also you're not supposed to be memorizing anything for logins. At the very least you should be letting your browser use the randomly generated password and save it to the browser password store if you're not using a full blown password manager.
For me I just see it as a sign of pretentiousness when you expect me to come up with a 20 character password. Luckily Firefox has a built in password generator now.
It depends on the forum and the hacker. Most hacks won't have a practical implication, but a targeted attack by somebody unhappy with your comments might abuse your identity or information the account reveals.
Or a forum can reveal information you don't want to have revealed (medical help forums, sexual stuff, ...)
And sometimes you are really to leave "child times" behind you, which might reach surface again later. (Say when you get into a political career ten years later and somebody finds your mail address and searches through dumps of leaked data etc.)
https://users.ece.cmu.edu/~lbauer/papers/2011/chi2011-passwo...