> What is the excuse for the average company to not enforce a policy? Oh, but most companies do enforce such a policy. Often, however, these policies do more h

> What is the excuse for the average company to not enforce a policy? Oh, but most companies do enforce such a policy. Often, however, these policies do more harm than good such when they require passwords of a specific length and composition or demand you change those every 30 days. Rules like that lead precisely to passwords that are easy to guess but hard to remember. I suppose nobody can even tell anymore who originally came up with these rules but they're widespread and ingrained in many companies' cultures. Getting rid of this security cargo cult and replacing it with better practices (such as using password managers and allowing for easily pronounceable, diceware-like passwords) is surprisingly hard.