Why must high entropy passwords be rotated regularly anyway? Shouldn't they only need rotating after a certain number of incorrect logins? Shouldn't that number be decently high?
Regularly changing your password reduces the impact of an undetected security breach by shortening the maximum amount of time a leaked password remains useful.
