[muf]

Originally Posted by Floris

He means it doesn't hurt to have users change their password anyway, despite the layer of security, passwords should be rotated more frequently to avoid abuse.

And that is why I said that if you do not require the password to be different (rotated) from the original password, users will simply use the original password. Also, security experts are returning from the old notion that frequent password rotation is secure; many companies have practically experienced that password rotation simply means users will start using weaker and weaker passwords, and when they are forced to use strong passwords, they will write it down on post-it notes and such in order to keep themselves from forgetting it. It is better to let users come up with one good password, stick with it, and let nobody intercept it, than it is to keep changing passwords until the whole meaning of the word password is lost. That said, the number of passwords I use (strong as well as weak) can be counted on one hand. But then again, I don't rely on passwords for most of my security.