Do not change that password

[deckeda]

Not familiar with the MS's employee's work in question but I've read similar laments from IT folk who know first hand, better than most, that many security policies are self-defeating, developed as they are seemingly in a vacuum that assumes the user has little else to concern themselves with, or that the policy won't add to the pile of other security measures already present. Anytime you stop by someone's desk and see the stickies taped to the monitor, under the keyboard etc. you know it's not working. The same with poor password choices.

It's not that people don't "want" to be insecure, but that they are willing to be so if productivity takes a hit. Security needs to be a balanced with a certain amount of convenience, or you'll wind up with that.