Your Password Expired. Your Risk Didn't.

Password expiration is a calendar pretending to be a security measure. A secret doesn't spoil like milk; it leaks, usually through reuse or a convincing email. Changing it every ninety days doesn't remove the leak — it just trains everyone to make the smallest possible edit: Autumn2026! becomes Winter2026!. Then it goes on a sticky note, because the new one is unrememberable and the old one is still in the fingers.

What the ritual actually produces is a paper trail. Somewhere a compliance checkbox gets ticked, and nobody has to discuss the uncomfortable truth: the weakest link isn't age, it's human trust in a message marked urgent.

I don't miss expired passwords. I miss the honesty of admitting that a deadline is easier to enforce than good habits.