This advice is back-assward.
The attacker who uses your stolen password is just as likely to be trying it a year from now than he is to be trying it the moment he captures it. Maybe he's not even the person who originally stole it. A stolen password for an account whose password isn't regularly changed is a backdoor that can't be patched or detected. It's actually more valuable in some ways than a rootkit.
This isn't idle punditry. Maybe once a year, I end up on a penetration test that works its way onto internal networks or desktops, and every one of those engagements invariably has a "here's the chapter of the report where we ended the universe" because one person saved a password somewhere a year ago and never changed it.
Yes, attackers will mount active attacks, and yes, attackers will install backdoors. But they will also sweep your machine for textual passwords and then bank them.
There are classes of passwords that don't merit regular changes. Your one-off passwords for sites like Reddit (please, don't share passwords between sites) don't need changing. I'm also not religious about changing single-purpose rarely-changed Keychain-generated passwords.
The rest of them, change at least once a year.
The attacker who uses your stolen password is just as likely to be trying it a year from now than he is to be trying it the moment he captures it. Maybe he's not even the person who originally stole it. A stolen password for an account whose password isn't regularly changed is a backdoor that can't be patched or detected. It's actually more valuable in some ways than a rootkit.
This isn't idle punditry. Maybe once a year, I end up on a penetration test that works its way onto internal networks or desktops, and every one of those engagements invariably has a "here's the chapter of the report where we ended the universe" because one person saved a password somewhere a year ago and never changed it.
Yes, attackers will mount active attacks, and yes, attackers will install backdoors. But they will also sweep your machine for textual passwords and then bank them.
There are classes of passwords that don't merit regular changes. Your one-off passwords for sites like Reddit (please, don't share passwords between sites) don't need changing. I'm also not religious about changing single-purpose rarely-changed Keychain-generated passwords.
The rest of them, change at least once a year.