This makes me wonder what would happen if you could have a company 'salt' which is known internally throughout and organisation and added to the end of your password, each month it changes... everybody would know the extension to their password (no forgetting) but it would make it difficult for outside brute force attacks, while making your password no less secure internally... or so my half asleep thoughts appear to suggest (of course, if somebody internal had already compromised your password it wouldn't help, but presumably at that stage its game over)