> The same is true for forcing users to reset their password every 50 days or so, by the way. This outdated password guideline doesn't seem to die. I know way to many cases where people are using a weak base password with a number attached to it because they got sick of trying to remember a new password every month.

there are people who actually invent a new password every time instead of cycling numbers?

also, change password a few times until history is flushed and switch back to the same password you started with is a thing.