On the second point, thankfully we now have the NIST password guidelines recommending against password expiration, so we have an authoritative source to point a

On the second point, thankfully we now have the NIST password guidelines recommending against password expiration, so we have an authoritative source to point at when fighting back against counterproductive password policies.