>Would a good takeaway be that expiring passwords would be helpful, if users weren't terrible about password management? I think that's a fair assessment. Pass

>Would a good takeaway be that expiring passwords would be helpful, if users weren't terrible about password management? I think that's a fair assessment. Passwords are doubly risky in that they're regularly touched by human hands, and often transmitted directly over the network. I think about security more often than many people I work with, but I recognize that I'm not immune to phishing myself. Rotating passwords sounds like a great idea, but in practice it results in people just choosing terrible passwords. Better to encourage systems that reduce the possibility for human error in the first place IMO (think WebAuthn and friends).