> There is no issue with periodically changing passwords in and of itself. I suppose this is true as long as you're not having to record the password in some i

> There is no issue with periodically changing passwords in and of itself. I suppose this is true as long as you're not having to record the password in some insecure place (like a sticky note on your monitor) because you can't remember it. In practice, this seems to require either (a) using a password manager or (b) keeping most of the password the same and just changing one or two characters (because learning a completely new random password every 90 days is too hard). In case (a), periodically changing the password is not harmful, but it's also completely pointless; just have your password manager generate a 16-character or longer password, and there's no need to change it, unless you're aware it's been compromised. In case (b), again, periodically changing it is not harmful, but it's also probably pointless. Consider that if an attacker learns your password somehow, and you don't know about it, they're likely to have weeks if not months of unfettered access. Then one day they try to log in as you and can't; seems like the first thing they're likely to do is to try small variations on the password they've been using, whereby they're likely to find your new password. Anyway, I've never heard of a user imposing a password rotation policy on themselves. Have you?