> regular password rotation has not been a recommendation for over 5 years It's just that it was a strident recommendation for 10 years prior to that, perhaps

> regular password rotation has not been a recommendation for over 5 years It's just that it was a strident recommendation for 10 years prior to that, perhaps because many systems didn't support long passphrases but it was drummed into enough heads that it is now "conventional wisdom" especially in many business and government "enterprise" shops. Even my latest employer, an academic institution with security folks who know better, still forces a passphrase change every other year.