(I'm kind of getting the feeling I completely failed to understand the point of this article, or am at least misunderstanding the point of the examples...so the following may be WAY off)

He's got a point about it not being clear if "Passwords need 10 characters" means they must be exactly 10 characters long or at least 10 characters long. It is the latter. If you put a password of less than 10 characters in the first password field, when you move on to re-enter the password it will immediately flag the error with the message "Your Password must be at least 10 characters long".

I'm a bit confused, though, by the imaginary dialog between him and two clerks showing how these requirements would work if this were done in person. To reflect the actual form, the dialog should be more like this:

HIM: Here is the password I want. (Hands paper to clerk).

CLERK: Passwords have to have at least one special character from this list. (Gives list to him). Your does not have one of these.

CLERK: Also, passwords can only contain letters, numbers, and characters from the special character list. (Point to the list he just handed over). You have a special character that is not on the list.

HIM: (Replaces the disallowed character with one from the allowed special character list) (Hands new password request to the clerk). OK, try this one!

CLERK: That meets our requirements.

I'm not sure at all where that part of his dialog about question mark being a special character but not a character comes from. The password "Ab345?7890" is accepted by the password checking JavaScript, even though it is exactly 10 characters long and so the ? must be counting as both a special character and as a character.

Don't get me wrong here...I'm not saying these requirements are OK. I find requirements like this annoying, because I use a password manager to generate my passwords. I can easily tell the password manager to include or exclude special characters, but I don't get to pick which special characters it picks from. At a site like the Post Office, which limits the set of special characters, I might have to generate several passwords before I hit one that is acceptable.

As a password manager user, what I really want out of sites is for them to allow long passwords, and place no restrictions on the characters in those long passwords. I will then use 25 character random passwords consisting of digits and lower case letters. That gives me 128 bits of entropy, but if it needs to be manually typed for some reason it is not too bad. I'm OK if they place some character requirements on shorter passwords...but if the password is long enough, let me do what I want.

So yeah, the requirements are annoying. I am just having a hard time believing that the red explanations that appear when the first password field loses focus were not sufficient to enable someone who programs at Google to manage to come up with a password acceptable to the Post Office.

I'd say the Post Office actually did a pretty good job of implementing the form. Most sites just tell you that your password violates the rules, and it is up to you to re-read the full list of rules trying to figure out which ones tripped you. The Post Office form tells you exactly which rules were violated.