The password expiry feature has expired!

There's a good summary of the history of password expiry in the late lamented Ross Anderson's Security Engineering (third edition - available online) from the bottom of page 99 here: https://www.cl.cam.ac.uk/archive/rja14/Papers/SEv3-ch03.pdf

In it he says:

> The first systematic study by Yinqian Zhang, Fabian Monrose and Mike Reiter of the password transformation techniques users invented showed that in a system with forced expiration, over 40% of passwords could be guessed from previous ones, that forced change didn’t do much to help people who chose weak passwords, and that the effort of regular password choice may also have diminished password quality [2073]

That's their 2010 paper at the ACM Computer and Communications Security conference "The security of modern password expiration: an algorithmic framework and empirical analysis" - online here: https://dl.acm.org/doi/epdf/10.1145/1866307.1866328