In ancient days we picked easy passwords that we wouldn't forget. If we used 'Juliet' as our user name, it was likely we'd use 'Romeo' as our passwords.
Then we'd be hacked or the site would demand a more complicated password. This wasn't hard. We'd still use Romeo, only this time we'd replace the 'O' with a '0' (zero).
Then sites began to issue or demand the passwords we could never recall. %4TK87F#_&%e so we'd write them down.
If you walk into any office, you'll find something like that on a 'post-it' on or near a monitor.
What is the point of a password that is so complicated that you have to write it down?
Okay, launching nuclear missile, yeah... a very difficult password that is written on something kept in a safe where the combination is written somewhere else.
But joining an online blogging site? A message board? Huh?
The more complex the password, the more it needs to be written down, the more likely you'll enter it wrong. And that means, you can't use your account.
Passwords should be easy for the user to recall. They should be the kind that one can take off the top of their head and simply change around a letter or two. Candycane, for example can become c@ndyC@n3.
And that kind of password can be remembered, has all the 'security' requirements, and doesn't have to be written down.
