Yeah, I just tried and confirmed that I still can't update my password on my desktop since I last tried on my phone this morning. It's just made that much harde

Yeah, I just tried and confirmed that I still can't update my password on my desktop since I last tried on my phone this morning. It's just made that much harder to try on a phone. I have no idea. OK, I lied. I have some idea. At a previous job I had a meeting with an enterprise customer who was auditing our security controls. Part of the conversation went a lot like this: Them: How often do you require your employees to change their passwords? Me: We don't. Them: Hehe, you'll have to start doing that! Me: We comply with NIST 800-63B section 5.1.1.2 that says not to do that unless you suspect a password's been compromised. Them: Uh, what? Can you send me a link? Me: You bet! My boss, to me in Slack: OMFG did that really just happen? Yes, I did have (and do have) that exact citation memorized because it came up often enough that it was handy to bust that out. "Do you rotate..." "NIST!" "...once every 90..." "SP 800-63B!" "...days?" "5 dot 1 dot 1 dot 2!"