Forcing password changes every 6 months is only bad policy because it isn't forcing you to change more often.
You are better off helping everyone understand the value of a passphrase vs a password.
This xkcd can help - http://xkcd.com/936/
You are better off helping everyone understand the value of a passphrase vs a password.
This xkcd can help - http://xkcd.com/936/
I have just always thought the forced changes were unnecessary if the password was strong enough to begin with, and managed in a proper/secure way on the server end. Because it doesnt matter if they password is one day, or 6 years old, the chances are that unless you are high priority, an attack on your password is a here and now event, not a prolonged attack (unless you are a direct target). Even in the event of prolonged attacks, there should be other measures in place to mitigate that avenue of exploit.
My only beef with non forced has been that over time, I feel the tendency for that particular password to be reused on multiple accounts would increase, therefore weakening it.
Like all theories though, I like to keep any open mind to all outlooks, I am by no means an expert. I just know that our policy's make me uncomfortable.