Password complexity requirements don't really help. Most people just wind up picking password001 or password #001. In fact, we almost ensure that people will wr

Password complexity requirements don't really help. Most people just wind up picking password001 or password #001. In fact, we almost ensure that people will write passwords down when we make them remember weird, long strings and make them change it every few months as part of an arbitrary password change policy. I remember reading a paper (can't find the reference now) on how password change policies originated in the 60s and there's no data to support that they actually help with security.