Password Expiry is Dead - Real-World Metrics on What Rotation Actually Achieves

Explore a conference talk that challenges the conventional wisdom of mandatory password rotation policies through real-world data analysis. Examine compelling evidence demonstrating how forced password expiry often leads to predictable password mutations rather than improved security, while simultaneously decreasing overall password entropy and encouraging counterproductive user behaviors. Learn about the measurable negative impacts of traditional rotation requirements and discover practical alternatives including time-to-crack scoring methodologies, event-driven rotation strategies, and credential risk threshold implementations that can provide more effective security outcomes than blanket expiry policies.