• Yes, which leads to yet another problem, password staleness. You make have thought up the easiest to remember, hardest to crack password, but unless you change it often, then you are still in a world of problem attack vectors.

    This is one of the nastiest security myths that exists

    Re-reading my comment, I didn’t fully qualify my brief comment, oops you are exactly right.

    What I should have said was, as people generally re-use passwords across systems, thereby opening themselves up to multiple attacks vectors. If one of those systems is compromised then it’s not hard to find others to try it with. Like with Antivirus that only detects 99% of issues, all you need is to be unlucky to get that 1% which made that 99% not even matter. One can get in a habit of password re-use (or staleness) and suddenly find themselves in trouble. I agree, frequent password changes is never a good thing for the user. Yes, if your password cannot be worked out and the system containing it doesn't get hacked, you can safely use the same password and never need to change it, but does that really happen?

    Only someone completely incompetent at serious security believes in changing passwords often (unless they have a situation where compromise is unlikely to be dsetected within the period between changes).

    This one I don't agree with so much. How easy is it to detect a compromise? How do you know when others have your password? How many systems display the number of recent failed attempts (or even since the last successful login) or successful ones, plus when they do, do you even take note? Until something destructive or unwanted happens and especially if you are only a user and cannot access the logs, you wouldn't know what read-only activity has happened. No, a stale password is no benefit here.