Password Expiry is Dead: Real-World Metrics on What Rotation Actually Achieves

The talk questions the long-standing practice of forcing users to change their passwords on a fixed schedule. The speaker traces this guidance to roughly 2010 to 2012 and argues that forced expiry pushed users toward predictable patterns, such as appending or incrementing numbers, instead of stronger passwords.

The core of the talk is cracking data from four anonymised organisations, with rotation intervals ranging from 30 days to more than 120 days. In the shortest-interval environments, a large share of passwords fell to simple incremental rules, with overall crack rates between roughly 70% and 89%. Longer intervals reduced those patterns, but the speaker stressed that they did not make passwords uncrackable. He also covered side effects such as more help desk tickets and users writing passwords down.

For alternatives, the speaker suggested time-to-crack scoring of the domain, resets triggered by credential-leak events rather than the calendar, entropy tracking per user, and MFA with secure fallbacks. Hashcat features for auditing were also mentioned. The takeaway is that rotation alone is not an effective control, and it should be replaced by strong passwords combined with risk-driven response.