Non-tech people have a fundamental misunderstanding of what makes a good password, and stupid IT policies like password expiration lead to really bad habits like frequently forgetting passwords, frequently reusing passwords, and end with writing it down on a post-it note.