the top three rules for passwords

So I'm trying and wanting to use a certain web site and it's another site that is asking me for my userid+password for a one-time authentication.  While I can appreciate the high level of security the site wants to impose on it's users due to the risk of fraud by bad actors, it reminds me of the three most important rules for a brick+mortar retail store:

1. Location
2. Location
3. Location

So the three most important rules for passwords are:

1. Never give out your password.
2. Never give out your password.
3. Never give out your password.

It still astonishes me that in 2017 there are Information Technology departments in companies who ask their users for their passwords to do troubleshooting.

No.  Never.