Why do we abuse our users with ancient password practices?