Nice, I always found forced password changes (except in case of breach) extremely annoying, hadn't ever looked for a resource that justifies my annoyance. http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf#page=23

Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.

Lots of other recommendations that are often annoyingly not followed in nearby text.

That publication doesn't really provide any justification other than by reputation, but turns out that's easy to find as well, eg:

• https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-rethink-mandatory-password-changes
• https://www.ncsc.gov.uk/articles/problems-forcing-regular-password-expiry
• https://www.schneier.com/blog/archives/2016/08/frequent_passwo.html

I think these probably all refer to the same research showing something like choosing/changing a password is costly, so if you have to do it often you'll do it worse.

Mike Linksvayer at 2017-07-30T19:51:55Z

McClane, clacke@libranet.de ❌ likes this.

It is hilarious when other government agencies don't listen to NIST about this.  My $BUREAU certainly does not and inflicts nasty requirements on employees.  Citizens doing business with the $BUREAU get a bit shy about digital interaction.

Stephen Michael Kellat at 2017-07-31T01:18:59Z

clacke@libranet.de ❌ likes this.

do they require to change the security questions too?

Hubert Figuière at 2017-08-02T18:46:56Z