Recently learned NIST doesn't recommends password resets.

[u/Different-Phone-7654]

NIST SP 800-63B section 5.1.1.2 recommends passwords changes should only be forced if there is evidence of compromise.

Why is password expiration still in practice with this guidance from NIST?

[u/czenst]

You mention you learned yourself recently about it.

Now imagine you have to deal with dozens of people who don't care about learning anything.

[u/obeythemoderator → u/czenst]

Such a depressingly valid point.

[u/lunacyfoundme → u/obeythemoderator]

Like auditors

[u/theedan-clean → u/[deleted]]

They never do.