The inconvenient truth about passwords
Inconvenience makes people do strange things. Having to wait at traffic lights sees people run across the road, risking life and limb just to get somewhere a few seconds faster. People allow packages to be "hidden" on their doorstop rather than secured at a post office. And people intentionally break the law to instantly download movies or music that they wouldn't mind paying for.
Inconvenience is the reason why no one wants to comply with strict password-complexity policies, or follow a number of so-called best practices.
On paper, complexity policies appear to solve the problem of brute forcing passwords. They ensure that hackers have more combinations of characters that they will need to guess. It's effective if hackers are going through passwords by changing one character at a time, but most hackers don't. In reality, most people respond to such complexity policies by taking their existing password and modifying it so that it meets the minimum requirement. This means that "password" becomes "Passw0rd!", or even "Passw0rd!Passw0rd!" to meet minimum length requirements.
