Password rotation doesn't fix that because the difference between myLongPassWordThatDoesntChange and myLongPassWordThatRotates7 is effectively meaningless. An a

Password rotation doesn't fix that because the difference between myLongPassWordThatDoesntChange and myLongPassWordThatRotates7 is effectively meaningless. An adversary who has your current password can almost certainly guess your next one because changing the 7 to an 8 is a pretty obvious step, and it's one that most people do when forced to rotate. Forcing password rotation guarantees that most people will just use the shortest possible password and stick some rotating suffix on it because your policy is pointless and annoying. You make yourself the adversary when you enforce policies like this and people stop trying to be secure and just try to get on with life.