Changing Passwords Every Ninety Days Mostly Teaches Us to Cheat

For years, workplaces made us change passwords every few months, and we responded the way humans respond to any rule that feels like a tax: we found the cheapest way through it. Spring2025! became Summer2025!, then Autumn2025!, a password that aged like a loyalty card. The rule looked like diligence, which was the point. It let an organisation show an auditor a calendar of effort while the real risks, stolen or reused credentials, went largely untouched.

What bothers me is not that the rule was dumb but that it was comfortable. Forced rotation moved the burden onto the person least able to carry it, and it asked for memory when it should have asked for care. Some security standards, NIST's guidance among them, have since dropped mandatory periodic changes in favour of long passphrases and changes only when compromise is suspected. Fewer rituals, more thought. The odd lesson is that the fastest way to make people careless is to keep them busy.