As of 2023, a 16 character password with just lower case letters could be cracked in about 713 years and the average employee stays with a company for about 3.9 years. I really think we are making people work to hard to make good enough passwords and that is how we get people making shitty passwords. And then we ask them to repeat this process every three months, and because getting a password reset is a pain in the ass they right “FuckTh15Pl@ce” on a sticky note under there keyboard (I found that one under a VP’s keyboard).

If we were doing passwords right it would be 12 characters, three character types, last until you leave the company or there is an incident. Also, by not requiring people to change the password every so often it one less thing for the IT Auditor to crab about.