[protonfish]

I don't agree with everything in this article and he glosses over some complex issues too quickly, but it is good to see such a reasonable discussion about actual password security in contrast to the pants-on-head mouth-breathing "security" standards of "enforce changing your password every 12 weeks" and "your password must contain an upper and lower case letter, number, and special character."

There are people that believe those practices have positive effects on authentication security. Those people should be identified and prevented from ever making a security-related decision again.