NIST doesn't "Advise Against Periodically Changing Passwords". There is no issue with periodically changing passwords in and of itself.
NIST is acknowledging that the typical user when faced with a password policy that requires a regular password change will choose a weaker password. NIST is advising against imposing a requirement to periodically reset passwords.
Maybe I'm nitpicking but the title as it currently stands is misleading in my opinion.
NIST is acknowledging that the typical user when faced with a password policy that requires a regular password change will choose a weaker password. NIST is advising against imposing a requirement to periodically reset passwords.
Maybe I'm nitpicking but the title as it currently stands is misleading in my opinion.