Password changing considered harmful

[Long item PGN-ed.]

https://www.wsj.com/articles/annoying-password-rules-actually-make-us-less-secure-a05edb70

Annoying Password Rules Actually Make Us Less Secure

Does your company network or a frequently visited website force you to come
up with a new password because it has declared your old one is past its
expiration date?

If you find that annoying, you're not alone. What's worse: It's actually bad
for cybersecurity, say researchers.

The scheduled-replacement policy is one of a number of poor or ineffective
password practices that make logging into sites, apps and …

bad changing cybersecurity expiration find logging network old password policy poor practices researchers rules website