Please do not group password rotation and special character restriction. One strengthens, the other weakens security. The only reason I can think that rotation would be a bad idea (aside from frustration, which is another very critical issue) is if users are not using strong passwords on each iteration.
The solution is for a standard to emerge that incorporates rotation and (optionally random) password generation used across sites. No more fucking "Login with Google".
The solution is for a standard to emerge that incorporates rotation and (optionally random) password generation used across sites. No more fucking "Login with Google".