Fully agree with the first post-it point, but I disagree with: > The only real solution is to let people use the word "password" if they really want. It's stil

Fully agree with the first post-it point, but I disagree with: > The only real solution is to let people use the word "password" if they really want. It's still orders of magnitude safer than having them keep a file/email/post-it full of plain text passwords sitting around in plain view. If I have "password" as password for my work webmail/remote login, it can be broken by any yokel on the internet with five minutes free time. If I have "ge.9u30!ey0" written on a post-it note on my desk, it can only be "cracked" people with physical access to my office. Also note that people who have physical access to my office already have security privileges similar to mine own, mitigating the actual risk - they can't do much more damage with my password than they could without. And if they wanted my private stuff, they could just as well nab my harddisk. Not that I'm justifying passwords on post-its in any means whatsoever, by the way. :-)