How to unlearn and relearn authentication?

The students' reality is identity-based authentication with passwords that must be at least eight characters, upper and lower case, digit and special characters. This is reinforced every day and is so wrong.

How do we unlearn what is reinforced every day? How can we make them learn how it should be, how can we make them retain this? How long will they retain it?