my IT staff still insists I change my login password every 90 days - and they ask that we do it over the phone, with other people around (I work at a magazine - everyone in my group has the same access to everything that I do). my response has been to make them as simple and easy to remember - and as guessable - as possible.