why do we still have to use passwords that are at least 12 characters long with a capital letter, number, and special character but can't