Good Essay on the History of Bad Password Policies

This post critiques the historical evolution of password policies, highlighting how early assumptions—such as the belief that complexity rules inherently produce strong passwords and the widespread hashing of passwords preventing effectiveness assessment—shaped decades of poor practice. It notes that only after large-scale password breaches were analyzed did the security community gain the empirical evidence showing users’ predictable, weak choices despite policy constraints.