Post
by Moonchild » 2025-07-19, 22:41
Our settings are a compromise.
We need to assume many people don't use a password manager, unique passwords for every site, and similar problematic practices. Breaches happen, and account data gets leaked/stolen/compromised with great regularity on the Internet, so to prevent account breaches by re-use/guessing similar passwords, we have to use a password rotation scheme. How often it is required tends to be the issue for people averse to it, and that's why the forum has a (very!) long password validity duration before you're asked to change it. On the flipside, we also don't force you to use complex passwords with capitalization, numbers and special characters; that is entirely up to you. We do enforce a 12 character minimum but you're free to make it up to 100 characters long if you want.
Ultimately, if you are confident your password is secure, you can change it and then change it back, as well. It's just not recommended to let actively used accounts go more than multiple years without a password change. Account guessing is a regularity on this forum; thankfully we've not really seen any of the accounts hacked so far, with our policies in place, so it seems to be effective.
Because this was introduced at a certain point in time for all accounts, these password change requests are kind of clustered around certain dates - that's just because they all expire around the same time for older accounts. That doesn't mean we've done anything on our end to make that happen -- if there would be a need for this kind of forum-wide account maintenance we'd be transparent about what happened and why a forced change would be necessary.
"There is no point in arguing with an idiot, because then you're both idiots." - Anonymous
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite
