Why we're still living with password rules their creator regrets

Key points

• Strict password rules, such as requiring capital letters, numbers and symbols, were based on logic rather than evidence. William Burr, who helped write the guidance in 2004, later said he regretted much of it.
• The US standards body NIST moved away from these rules in 2017, but many websites and workplaces still use them. Researchers found the rules often led people to reuse passwords.
• Experts now advise using a password manager and choosing long passphrases.