In defense of password expiration
[Edit: This entry was posted in 2006. I no longer consider password expiration to be a useful security measure. Please see my new post on this topic here or here. I've also added some in-line comments below.] Recently, as noted on Slashdot, Gene Spafford, author of Practical Unix and Internet Security and one of…