> A trivial example: IT requires users to change their passwords every N days. So users start with "password", and when they are required to change it, they use

> A trivial example: IT requires users to change their passwords every N days. So users start with "password", and when they are required to change it, they use "password1", then "password2", and so on. Fortunately in the latest NIST Digital Identity Guidelines this case is explicitly discouraged [1]: Do not require that memorized secrets be changed arbitrarily (e.g., periodically) unless there is a user request or evidence of authenticator compromise. [1]: https://pages.nist.gov/800-63-3/sp800-63b.html#usabilitycommon https://pages.nist.gov/800-63-3/sp800-63b.html#usabilitycomm...