Microsoft: Mandatory password changes considered harmful

They're right, as I've said for a long long time.  The security industry has been moving in this direction for a few years, and now Microsoft seems to be throwing their weight behind this.  Their explanation makes tons of sense:

In last month’s blog post, Microsoft's Margosis wrote:

There’s no question that the state of password security is problematic and has been for a long time. When humans pick their own passwords, too often they are easy to guess or predict. When humans are assigned or forced to create passwords that are hard to remember, too often they’ll write them down where others can see them. When humans are forced to change their passwords, too often they’ll make a small and predictable alteration to their existing passwords and/or forget their new passwords. When passwords or their corresponding hashes are stolen, it can be difficult at best to detect or restrict their unauthorized use.

...

He added:

Periodic password expiration is a defense only against the probability that a password (or hash) will be stolen during its validity interval and will be used by an unauthorized entity. If a password is never stolen, there’s no need to expire it. And if you have evidence that a password has been stolen, you would presumably act immediately rather than wait for expiration to fix the problem.

Anything that gets users out of having to choose new passwords every 60 days is a big win for everyone's security - as long as password updates are required if you think that the password has been compromised.  Long passwords (more than 11 characters) that are easy to remember are best, like the passphrase that I posted about in the first link above (only longer than that one, which was posted back in the days of 8 character passwords).

Now that we're seeing some of the Big Boys taking this approach, maybe we'll see more sane password rules coming around.