>cyber criminals almost always use credentials as soon as they compromise them.
There's still the problem of breaches in unrelated services, which must be considered as part of the attack surface when users can just use a single password anywhere. This to me seems like the most obvious benefit of expiring passwords.
There's still the problem of breaches in unrelated services, which must be considered as part of the attack surface when users can just use a single password anywhere. This to me seems like the most obvious benefit of expiring passwords.