How the most brilliant computer scientists got password policy so wrong