password auth: Avoid mandatory password rotation

This aligns with NIST SP 800-63B, Microsoft 365 Password Policy Recommendations, etc, etc
pilcrowonpaper · Oct 21, 2024 · 1dce38d · 1dce38d
1 parent b44acc0
commit 1dce38d
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/pages/password-authentication.md b/pages/password-authentication.md
@@ -138,5 +138,6 @@ If you need to keep the username or email private, make sure you do not leak suc
 ## Other considerations
 
 - Do not prevent users from copy-pasting passwords as it discourages users from using password managers.
+- Do not require users to change passwords periodically.
 - Ask for the current password when a user attempts to change their password.
 - [Open redirect](/open-redirect).