The silly password rules aren't great, but on the whole I think of the issue more as "account fatigue" (which is sort of mentioned in the opening paragraph and

The silly password rules aren't great, but on the whole I think of the issue more as "account fatigue" (which is sort of mentioned in the opening paragraph and then largely ignored). At work alone, I have: 1) A Windows domain account 2) A GitHub account 3/4) Accounts for two separate project management web apps 5) An account for our own web app 6) An account for the payroll web app 7) An account for the HR performance appraisal web app 8) An account to register for on-site flu shots 9) An account on a project development VM 10) An account for the outsourced IT security training And probably a few more that I forgot because I'm not in front of my password manager right now. It also doesn't help that we have a narrative around "identity theft" that puts virtually all of the burden of a leak on the account holder, even in cases where it was unequivocally the company's security that failed.