In 2003 a mid-level manager at the National Institute of Standards and Technology sat down to write eight pages about passwords. Bill Burr was not a cryptographer, and he has said since that his source material was mostly a white paper from the 1980s, written years before the web as we know it existed. The little primer he produced, Appendix A of NIST Special Publication 800-63, told the world to invent awkward nonsense strings, heavy on capitals, digits and symbols, and to throw them away every 90 days. Banks, universities and government agencies adopted it almost word for word. For over a decade it was simply how passwords worked.
Then in 2017, retired and 72, Burr told the Wall Street Journal the sentence anyone who has ever clicked "forgot password" already suspected: "Much of what I did I now regret."
The rules failed exactly the way human beings are built. Told to change passwords constantly, people made the laziest possible edit - Password1! became Password2!, Spring2024! became Summer2024!. The capital landed on the first letter, the digit and the exclamation mark on the end, every single time, because who has the energy for anything else on a Monday. Cracking tools learned those habits years before any committee revised its policy; a pattern is not a secret, it is a template with a blank in it. Some people just wrote the current password on a note under the keyboard. Security gained: close to nothing. The bill ran for fourteen years.
The thief never sees the prompt
Here is the part I cannot stop thinking about. The 90-day rule was written for an attacker, and the attacker never had to obey it. He pulls the password database and cracks it offline, on a rented rig, on his own schedule. Your expiry prompt has no jurisdiction over his GPU. The only people the rule ever governed were your own users: the honest ones, trying to log in and pay you.
A rule that costs its target nothing and bills everyone else minutes a week is not a control. It is a tax with a security sticker on it.
The industry even has a name for controls that manufacture the feeling of protection while doing little: security theater, the phrase Bruce Schneier coined. The 90-day expiry prompt is the longest-running show in that theater. It runs on schedule, in front of an audience that was never the threat.
Once you see the pattern it is everywhere, especially where money changes hands. Baymard's 2026 abandonment research finds 18% of US shoppers have left a cart because the site demanded an account before checkout, 17% because the process was too long or complicated, 19% because they did not trust the site with their card details. Every one of those percentages is an honest person. The card thief never stood in that line - he buys stolen card numbers in bulk and sends a bot through checkout at 3 a.m.
Bad rules live long for a plain reason. Their cost is spread across a thousand invisible minutes belonging to people with no vote in the policy, while deleting one is a single named decision somebody could later be blamed for. That asymmetry, not threat modeling, is why NIST retracted the expiry advice in 2017 and the portal you logged into this morning can still demand a fresh password every quarter. The rewrite happened; the adoption never did. Paul Grassi, the adviser who led NIST's do-over, said the old requirements did little for security and had "a negative impact on usability." The replacement says long passphrases, no forced expiry, change only on evidence of compromise. It is simpler than what it replaced. Of course it is. It was written by people who finally asked who was paying.
So this is the test I would carve into every product review: before a rule goes live, ask who pays when it works perfectly. Name the person the cost lands on. Name what the attacker actually loses. If the honest user pays and the attacker routes around, you have rebuilt the 90-day expiry. If the attacker pays and the honest user never notices, you have the good kind - a verified webhook signature costs a forger everything and the customer nothing; a card form the merchant's page never touches costs a skimmer his harvest and the buyer not one extra click. Armor where the attacker operates, silence where the honest user does.
The form with nothing to steal
Bid Spotlight sells rank position for real money, so I get to run that test on a form most sites never audit: the intake form. It asks for six things. The site's URL, a tagline, a short description, a bid amount, an email, one optional image. One checkbox beside them, and that is the entire form. No password. No account creation. No phone number, no date of birth, no name of a first pet.
That shortness is the security posture, not laziness. A small table cannot leak what it never stored, and every field we decline to ask for is a record that can never be stolen from us. The work that actually stops attackers sits where no user ever looks: a submitted URL is fetched only through a guard that cannot be aimed at internal machines, and no rank moves because a redirect URL said "success" - position changes only when a verified Stripe webhook confirms the payment, server-side. No password resets to intercept, no security answers to brute force, no vault to rob. Less ceremony on the surface, less to defend underneath.
Bill Burr's real mistake was not the math; it was writing rules for an attacker he never studied and billing them to the people who were never the threat. The honest will stand in any line you draw, which is exactly why the line belongs where the thief walks - claim your six-field spot at https://bidspotlight.com.