Here is a blog post with a report of an an too common experience.

---Tom Hagan 

"...It's finally happened.  All the passwords, usernames, and security questions that I have tried to keep manageable have all merged into one big Login in my head.  I'm trying to get into my T-Mobile email account, which is a different login to my T-Mobile phone account (why, T-Mobile?).  I think the username is my mobile number, but I can't remember my password.  it's not any of my standard ones, which means they probably forced to have another one.  so I clicked on "I forgot my password", and I'm told that I have set-up a security password that will allow them to email my details to me.  did I?  now, if I can't remember my original password, what's the chances I'll remember this special one?  why can't it be a nice security question like "what's the name of your cat?"  I think I can just about remember that one.

And while I'm moaning, let's hope that when I finally get my password from them they don't email it to me in plain text, which has happened 4 times in the past 2 weeks..."

http://www.cs.bham.ac.uk/~rxb/Teaching/HCI/blog/2004/07/password-chaos-its-finally-happened.html

This from a front page Wall Street Journal story tells a tale of how enterprise employees cope with Password Chaos--by subverting security.

---Tom Hagan

Wall Street Journal, December 9, 2004, Page A1:

"Trying to Remember New Passwords Isn't As Easy as ABC123"

"Before she begins work each morning, Kate Prior must enter eight computer passwords. Each must contain at least eight characters, and most require letters and numbers. Every three months, she must change them all.

How does the 28-year-old monitor of drug trials remember her passwords? Easy: They're written on a blue Post-It note affixed to her computer.

Ms. Prior knows that her display threatens to undermine the very security that passwords are supposed to promote. "The IT people yell at me," she says, referring to her company's information-technology staff. But she prefers the occasional scolding to the alternative: forgetting a password, guessing incorrectly three times, and then having to call for help.

Security experts have long recommended that computer users choose hard-to-break passwords and change them frequently in order to frustrate hackers. Now, those recommendations are being newly forced on millions of U.S. workers in the name of preventing financial fraud under the Sarbanes-Oxley corporate reform act...."