Some of the most brilliant computer scientists got password policies so wrong