CESG (UK cyber-security agency) advise against forcing regular password expiry | Hacker News Reader