Actually I think that forcing users to change their passwords doesn't really improve security and it may well decrease it. Good passwords are hard to memorize

Actually I think that forcing users to change their passwords doesn't really improve security and it may well decrease it. Good passwords are hard to memorize and if I'm forced to change it every few months then I can do two things: change it as little as possible (e.g add a number or a character at the end and cycle between them as allowed) or use a weak password (and maybe do the same with it). Now if one has a lot of accounts and passwords and tries to be safe and use an app like passwordsafe then the ignorant service operators (e.g. my bank...) who force frequent password changes can turn life into a really bad experience forcing us to do password changes every few days on one system or the other (or just force the user to give up on secure passwords). Now if someone wants to secure their system then they should use two factor authentication. Now that everybody has a mobile phone, basically everybody has a secure token. (I know that mobile phones are not that 'tamper resistant', still they are something that an attacker has to have their hands on. And you'll probably notice if you loose your phone sooner than you would notice your purse.)