I am a fan of secure passwords, but less so of ones that change monthly. I find that it increases the odds that a user will write it down, not decreases them. Certainly computer systems need to be secure, but they also need to be used by fallible human beings. Make it too awkward and human nature dictates that they WILL take highly insecure shortcuts. The problem of course is that these insecure shortcuts are taken even if the process is made easy for them. We can't win either way.