one thing that is both intentional and annoying when it comes to passwords, is the habit of certain sites (like bank sites) to force you to change your password every few months. nobody seems to have told them that this is a security flaw or they just don't care. making people change passwords all the time, makes the average user to either use variations of the same password or make the passwords as simple as possible because its a hassle to come up with new strong passwords all the time, making the accounts easier to compromise in the process.