My uncle handed me a sticky note in 2011 with one password rule and I finally get it now
He was setting up my first email account at his kitchen table in Toledo and wrote "long beats weird" on a Post-it, saying a 20 character sentence beats "P@ssw0rd1" every time. I ignored him for a decade until my work account got locked after a phishing email in March. Anyone else have an old school trick that turned out to be right?
Long beats weird" sounds nice until you remember that most people reuse the same three passwords everywhere. A 20 character sentence is great until it's "iloveyoutoomuch123" and it shows up in a data breach from some random shopping site you forgot you signed up for. The lockout in March wasn't the password's fault, it was the phishing email. A long password doesn't stop you from clicking a bad link. So the Post-it trick is solid advice, sure, but it's not some magic fix people make it out to be.