Passwords should be 128 digits that even grandma can do; instead we have 11 to 13 digits to mirror. A password should be a semi-composite, one-way trapdoor function that gets factored out into two large primes that only grandma knows. Unless a pre-installed key-logger is in, you can't break the password, but Grandma, or you, or the bank, or DoD puts in there two small phrases (e.g. "Eddie loves pecan pie" and "Marie died in the valley") and that factors the password. Robert Morris's 1975 idea got used for messaging; it is time we lock passwords that challenge you to factor rather than mirror.