This is sadly all true. Password policies like "you must/must not use this characters" are bad and the worst are "you must change this password every six weeks"

This is sadly all true. Password policies like "you must/must not use this characters" are bad and the worst are "you must change this password every six weeks". The first is a restriction which prevents well memorable passwords, the seconds enforce throwing away a good password for another on. So users do what? The look for a pattern to pass this test, a acceptable solution is a famous german football club "Schalke04" or use the month "June_06". The enforced changing passwords was never a good thing. At least the german language differs between a password (Passwort) which is assigned to one person and parole (Kennwort) which is common for all allowed persons. And yes, Windows still ask for a parole like Win98. The last known users of parole where the soldiers of the ancient roman empire. It was required to change it rapidly, because some Gaul oder Germanic could have beaten it out of a soldier. The IT applies security measures from the ancient Romans! A password instead must match 'you' and only you can use it, the guard must know you (e.g. passport) and you need to know the personal password and it doesn't allow for bringing others into the camp. Well. A nowadays some people recommend passwords with the length of an SSH-Key because "Computer getting faster". Seriously - NO! It the computers job to lock your account for some time and making a computer based attack useless. Linux is doing that on your TTY with a few seconds and GNOME is temporarily banning you for 10 minutes. Even an iPhone does this. And yes, one long and well memorable password which is not easily guessable is fine. By the way, SSH-Keys are a fine and good thing for automatic authentication. And Microsoft has a shameful history, so called "Security Questions" which are often enforced. What is the family name of your mom? Your favorite meal? The name of your pet? What is wrong with Microsoft. It not a security question, it is a wide open backdoor. And now TPM? The correction description of TPM is "We don't trust you, you must trust us". Well, trust is a mutual thing?