Yep. All the more infuriating. They know better. NGOs, private industry and the US government at most levels there has been a movement away from password lengt

Yep. All the more infuriating. They know better. NGOs, private industry and the US government at most levels there has been a movement away from password length limits and password expiration and SMS as a second factor. (Even OTP and hashes may be replaced by U2F keys someday.) Then we get this recommendation for password expirations. Two steps forward, one back -- as always.