Long and complex passwords are as easy to brute-force than short and simple ones. They only make users' lives miserable. Password-dependent authentication mechanisms should be reversed and replaced. Reversed:...
Continue Reading use two-factor auth mechanisms and other methods based on the server knowing the users rather than based on the user knowing something stored on the server. Replaced: require cryptographically signed signatures instead of password. A crypto signature is like a 1024 to 4096 characters long password and can be stored on the devices in a much safer way than users store passwords anyway.