Citibank’s AccountOnline.com’s login page is absolutely broken. If you have no idea what your “security word” is and ask for a hint, you’re essentially told that it could be anything, including nothing. That really isn’t much a hint, because its safe to assume that your security word, if it exists, expresses some concept in the universe of concepts. If you’re asking for a hint, you what concept you’re supposed to guess from. But no. Citibank tells you “It’s a valid string of characters, including the null string.” Gee. Thanks.
However, if it’s actually nothing, you’re screwed, because the security word is a required field, and so you’re not allowed to enter if your security word if it’s actually the null string, which they specifically say is a valid security word.
God! How the hell does this pass testing? Sadly I know the answer. There is no testing.