> And current "best practice" is that enforced periodic password changes are counterproductive: ...
I very much agree.
And since I'm a "free agent" and not an employee, my response is totally up to me.
On a related note, a few months ago my company, having a few thousand employees in several locations, abandoned this practice (expiry every 3 months) as well. Probably due to negative experiences - which usually means increased costs.
Add this frequent change to very strict password rules (length, characters, etc.), and you create the very opposite effect - people quickly forget their passwords, because this is contrary to how the human mind works.
Which on one hand created a torrent of helpdesk requests because users could not login anymore.
And worse, other noted their enforced "arbitrarily complex" password down on paper or a text file ...
