> Your assumption is that there's zero time between a leak and the abuse. If my password reaches the abuser after it expires, then I have been saved by the rot

> Your assumption is that there's zero time between a leak and the abuse. If my password reaches the abuser after it expires, then I have been saved by the rotation. Nope, that wasn't my assumption. What I said above applies there equally. > Also rotation + "no reuse" policy essentially guarantees that eventually the password will be unique and not reused across services. No it doesn't, in fact it increases password reuse and results in pattern-style passwords.