I once audited a company that was extremely proud of its password policy. Sixteen characters minimum, upper and lower case, numbers, symbols, rotated every thirty days, no reuse of the last twenty-four. On paper it was a fortress. In reality, when I walked the floor, roughly one desk in four had a sticky note under the keyboard or on the monitor bezel with the current password written on it in ballpoint. The policy was so hostile to human memory that it had quietly trained the entire workforce to defeat it, and it had done so in the name of security.
This is the trap that catches well-meaning security teams over and over. You reason about the policy as if people were machines who would simply comply, and you optimize for theoretical strength. But every control you impose has a human on the other end, and if you make the compliant path unbearable, people do not become more secure. They invent a workaround, and the workaround is almost always worse than the risk you were trying to prevent. A hard password in your head is safer than a slightly harder one taped to the screen.
The thirty-day rotation was the worst offender. Forced frequent changes do not produce twelve strong, distinct passwords a year. They produce one root password with a number on the end that increments every month, because that is the only way a normal person can keep up. You have added enormous friction and gained almost nothing, because the attacker who cracks Spring2026 can guess Summer2026 without breaking a sweat. The policy generated pain and the illusion of progress in roughly equal measure.
What actually moves the needle is designing controls that work with human nature instead of against it. A long passphrase people can actually remember beats a short cryptic string they cannot. A password manager removes the memory problem entirely, so length and uniqueness stop hurting. Multi-factor authentication makes the exact strength of the password far less critical, which lets you relax the rules that were driving people to the sticky notes in the first place.
Security that ignores how people behave does not make you safer. It just relocates the vulnerability from the system, where you were watching, to the desk drawer, where you are not.
– Serguey Shinder
Top comments (0)