NIST proposes barring some of the most nonsensical password rules: The US National Institute of Standards and Technology advises that it’s counterproductive to make users set passwords with specific composition rules or change them regularly.