Forced Password Rotation Is Security Theater
Make people change their password every ninety days and you do not get ninety days of fresh security. You get Summer2024! followed by Autumn2024! followed by a sticky note on the monitor. NIST stopped recommending scheduled rotation years ago, for exactly this reason: it trades a small theoretical gain for a large, measurable decline in […]