The good news is that the practice is going away NIST revised it's guidance/recommendation for password cycling.
You can tell a company has this policy when every monitor has a sticky note on it with the numbers 1 to N on it, where 1 to N-1 are crossed out.
Yes indeed. For example they add the current year and month and keep the same "base password" which is unsafe.
"Password2017" is a typical "secure" password. Capital and small letters, and number - longer than 8 characters. Passes most "checks" for passwords...
"Password2017!" is even better. It's got a special character!
My favorite "pattern for stupid passphrase requirements" is "1qaz@WSX" - then just move a row to the right with every password change. :)
Funny how most people go for ! as the default special character :)
It adds to the excitement of logging into an application. Instead of "login", you get to "login!".
In my experience, overly restrictive password policies force users to choose passwords that are less secure and easier to remember.