Sure it does. A lot of people re-use passwords with different services, so if one gets compromised, then criminals have that password.

On top of it, people get compromised all the time. Its trivial for a virus to nab your saved browser passwords. Or someone sends you a phishing link and you happily type in your credentials. It looked official, right?

All of this is invisible to the end user, typically. From the IT side of things these credentials are used for all sorts of things like authenticating with smtp to use our mail server to send spam, log into ftp sites to host malware, etc, etc. Then the end user angrily walks up to IT saying, "Everyone is saying my emails are spam. Why do you guys suck so much??!!"

Forcing password rotation helps with this because there's a chance the password that got leaked is or will soon be retired. It also helps in scenarios when employees give their passwords out to other employees and then one of them gets fired and starts fucking with the system using someone else's credentials.

In short, a lot of these polities exist because people are stupid. Don't blame those of us trying to mitigate the damage. That said, you don't need a 30 day expiration. I find 120-180 days works well enough. You don't need complexity turned on as much as you need a sane minimum length. I'd rather train people to use "mydogsnameisAlbert" than "Password1"

I disagree. I am always hearing about how this or that service got compromised and stored passwords in plaintext or something, and now all those passwords are in the wild. I write really hard to crack passwords (funny little poems I made up myself) and I still could get screwed because my bank stored it in an unsafe way, and now some russian dude knows my password is "I am so þirsty,5/but þe walls are unbroken.7/Where is Cool-Aid Man?5"

Thus, I find myself writing new poems all the time. Which is actually great because they are fun to make and easy to remember. But yeah if I still used that one (something I wrote in 2008) I'd be screwed. There's no way that's safe now.

What really drives me insane are services that limit the number of characters you can have for your password. Holy criminy that's dumb.

No, but people often use the same password for different services. Changing passwords regularly can cut off attacker access in the event of an undetected compromise.

30 days is a little aggressive but I do think a quarterly or ever 6 months is valid. Not all users behave appropriately with their passwords, allowing other people to use them, re-using them between systems or putting them on post-it notes under their keyboards. The rotation of the credential is simply a cheap but heavy handed way of dealing with those compromises to ensure the system returns over time to a default state of security and cuts out invalid access. Granted a better way to manage this is create good audit trails of how often, during what times and from where and what devices those credentials are used, but like I said it's a simple/cheap way of adding that layer of security.

What I hate is systems that require you to

8 characters or longer

lowercase

uppercase

number

random symbol

As far as I am concerned if I want to make my password jumping I should be able too, forcing someone to make a password they will never remember leads to several issues.

1. A password cracker knows exactly what to ignore which such requirements (obviously his 4 letter word dictionary is useless in this case).

2. People have trouble remembering them, so they typically write them down somewhere (a even bigger issue).

3. It's security through obscurity.

You have to stagger them in your environment. If you don't, you get flooded with password change/reset requests the first few days after a change has been forced.