It’s axiomatic that passwords should be a mix of letters and numerals, if not uppercase, lowercase, and special characters. But don’t let the perfect become the enemy of the good. Forcing users to change their passwords too often, or imposing overrestrictive policies, leads to more password-bearing Post-Its taped prominently throughout the workplace. The best authentication combines something you know, like a password, with something you have or are, like an RSA token or a biometric fingerprint.