But then how will Cyberark make money?

I expect you have 3M lobbying on the other side of the issue in the interest of post-it sales.

I am so sending this to our district IT people the next time they make us change our passwords at school.

NIST discourages it, but most of the US government still requires it. In fact, I used to have a 60-day password rotation policy with such brilliant requirements as "no more than three characters of one class sequentially."

I soon realised that "ShitFuck!", thus, was a valid password -- and off I went. Meanwhile, a teammate who had previously been a technical writer contracting with the NSA told of the "waterfall method" -- not of software developments, but of passwords. It was common in his world, apparently, and you could always hear he was typing his password by the staccato of QazWsxEdc123, etc.

It's always amuses me what a domain name with a number in it ticks '3 of 4'.