Also in the pages that he links, they explicitly warn against password rotation. >> https://github.com/OWASP/ASVS/blob/master/4.0/en/0x11-V2-Authentication.md#

Also in the pages that he links, they explicitly warn against password rotation. >> https://github.com/OWASP/ASVS/blob/master/4.0/en/0x11-V2-Authentication.md#v23-authenticator-lifecycle https://github.com/OWASP/ASVS/blob/master/4.0/en/0x11-V2-Aut... >> Note: Passwords are not to have a maximum lifetime or be subject to password rotation. Passwords should be checked for being breached, not regularly replaced.