Microsoft has recognised that users don't actually change their passwords when prompted, they just tweak them. And that doesn't help anyone.