> Have his rules even been proven to be right? The rules, if used properly, work perfectly. But using them properly is burdensome, which means most people get

> Have his rules even been proven to be right? The rules, if used properly, work perfectly. But using them properly is burdensome, which means most people get lazy and the result is insecure passwords. There are about 95 letters, numbers, and punctuation marks and symbols. If you choose a 12 character random password, it's uncrackable by brute force. The problem is, few people want to choose and remember a 12 character random password, and fewer will do that for each of the dozens of passwords they must use, so they choose insecure, non-random passwords.