Why are there organizations, websites that still, in 2015 advises that people should use complex, at least 8 character long passwords?
Why doesn't they advise to use password-managers, long passwords? People will not remember complex passwords in every 90 days.
Is there some kind of old standard for the password rules? Or people don't know the math?
The same reason that people are still pushing for input sanitation in 2015: the security world moves very slowly; they adopt things at a snail's pace, and the end-users are orders of magnitude slower at changing their ways.
Once people have become accustomed to a way of doing something, anything that is contrary to that is going to be rejected for a long time, until enough people are crying about it. Even then, you're going to have a few holdouts like Dave. That's one of the core reasons why people are still proclaiming outdated practices.
Getting older people to use a password manager may be next to impossible.
People will not remember complex passwords in every 90 days.
Most people write their passwords down and put them on their desk in the form of a sticky note, or they type it enough times to remember it, or they even store it in a text file on their desktop (groan), or they set it and forget it with a long-lasting cookie.
And if they forgot it, no problem! They'll just start the password reset process. This is normal behavior for most users.
Is there some kind of old standard for the password rules? Or people don't know the math?
The vast majority of people, including developers, don't understand better password practices at all. Even less people understand the math or reasoning behind why something should be the way it is.
If people aren't knowledgeable, and you appear to be in the know, then people will blindly accept what you tell them... but even if they agree that password managers and pass phrases are better, old habits die hard.
If a website advises you to use a password manager, and then the password manager suffers a data breach of some kind, the website might be legally liable, since you were following their advice. If they just advise you to remember a complex password then there's no risk to them, since if you write it down that's your fault.
