&gt; people that can read a CVE or parrot &quot;best practice&quot;, but not really grok the subject or think critically about it (e.g. jumping from one password to another every 3 months isn&#x27;t &quot;more secure&quot;)<p>So much this.<p>One place I worked had a head of security that switched us to having passwords that auto-expired every 30 days, had annoying requirements (mix of upper, lower, numbers, and special characters) and not allowing reuse of a password for 1 year.  The increase in people having problems was handled by having &quot;security questions&quot; and self-service password resets.<p>My insistence that &quot;security questions&quot; were just unexpiring, easy-to-guess passwords was met with &quot;But this is the standard!&quot;.  Pointing out that rapid turnover of hard-to-remember passwords led people to write them down generated a similar reaction.