For years the standard advice was to build a password from mixed cases, digits, and symbols, and to change it every ninety days. Both halves of that advice have now been withdrawn by the bodies that issued it. Forced rotation, it turned out, made people choose weaker passwords and vary them predictably, appending a digit that matched the quarter. Complexity rules produced strings that were hard for humans to remember and no harder for a computer to guess. The current recommendation is a long passphrase, changed only when there is reason to think it has been exposed. The reversal is a useful reminder that security advice is an empirical matter, not a moral one.