> password simplification is a user choice, not a causal effect The two are not mutually exclusive. If you require users to change passwords regularly, and als

> password simplification is a user choice, not a causal effect The two are not mutually exclusive. If you require users to change passwords regularly, and also make sure the new password is sufficiently different from the last one (like, most characters must be different or something), guess what the users are likely to choose of their own so called free will. And I'm not even speaking of how you must store a password to be able to tell that a new password is sufficiently different from all the old ones. (Hint: probably plaintext.) > […] "forced" password expiration [is] often the only way to ensure that the end user actually updates their password regularly. That does not work. I have defeated it in my last gig with this simple method: Complicatedpassword1 Complicatedpassword2 Complicatedpassword3 Complicatedpassword4 Complicatedpassword5 And I will do it again, because a complex password that never changes is much more secure than random crap that I will have to simplify just so I can remember it. Also good luck trying to defeat my strategy (or similar strategies) without storing more than a hash of the password, properly generated with a memory hard function like Argon2.