Your comment is bullshit. Allow me to explain why, I'm not attacking you but the idea that this is an IT problem. IT has nothing to do with the problems of pass

Your comment is bullshit. Allow me to explain why, I'm not attacking you but the idea that this is an IT problem. IT has nothing to do with the problems of passwords in computer security. Their policies, while likely now outdated are there to act as CYA "industry best practices". The issue they're up against is they cannot secure your data with bad or poorly chosen passwords in the current environment. Your vitriol is misguided here, while at the same time understandable. The "requirements" of things like one upper case letter, a digit, a nonchar etc... were put in place when systems had only 8 characters for passwords. Ideally these wouldn't be hard requirements but work on a sliding scale based on length. In other words, 8 chars NEEDS the extra entropy and character classes to work. The longer you go however the less need you have for this requirement. Not that it goes away mind you, just that once you reach 12 char passwords, requiring those character classes becomes less useful than optimizing for something a human can remember. Basically I agree, requiring many character classes is non-useful and harmful. But only for long passwords, or passphrases rather. "one two three four" is a much harder password to crack, even with perfect foreknowledge that I only used lowercase words, didn't capitalize, and didn't put a punctuation character on the end than say "Ab&2x.!(" is. The latter looks like it would be harder to guess, but its length betrays its search space. It is also less secure in that it encourages users to write the password down. Moving on to the real crux of the issue. The bigger underlying problem you elude to, but never enumerated, is that security wise, we've NEVER had mathematically proven security in computers up until about 3 years ago, if even that. Even then this is leading edge research. What I mean by that is cryptography right now has only recently had A mathematical proof of it doing what we want it to be doing. Basically, making sure that A and B can communicate without worrying about third party C reading it. Even then this new cryptography could be flawed. Read up on homomorphic encryption, Craig Gentry's Phd thesis paper: http://crypto.stanford.edu/craig/craig-thesis.pdf http://crypto.stanford.edu/craig/craig-thesis.pdf And a more general introduction to its concepts (the math is quite involved): http://www.americanscientist.org/issues/pub/2012/5/alice-and-bob-in-cipherspace http://www.americanscientist.org/issues/pub/2012/5/alice-and... The problem here is we are in the dark ages of cryptography and computers. We like to think we're running on advanced things here, but the truth is this stuff is anything but. Things change, slowly. But you can't make fundamental shifts quickly just by hunkering down to solve things. It has to be provably useful. As to alternatives to passwords, I can't find the research paper right now but there was research done that would have you play games/type stuff and look at how you type/do things. The best part is you yourself don't even know your own password, it is a tertiary aspect of you behavior. The intention was for securing data for military purposes so that even under torture you wouldn't be able to give up your own secrets. This too is only a few years old. Hopefully some security minded people can correct me on my hastily written reply here or tell me why I myself am wrong. >.<