@ivanborgiey wrote:Why is the answer is No expiration? I checked the NIST 800-63b but I didn't find anything about it
Look at 10.2.1 Intermittent Events:
"Do not require that memorized secrets be changed arbitrarily (e.g., periodically) unless there is a user request or evidence of authenticator compromise."
I think this gets overblown as "Don't change passwords." What NIST is saying is don't force users to change an effective password because, eventually, they will probably choose a bad one. This doesn't mean users, at their own choosing, shouldn't occasionally change their password. Or that security awareness training should discourage users from changing their passwords from time to time.
NIST suggests passwords should be checked against known breaches, and if a password matches one in such a breach, it should be changed. But if you are following other NIST recommendations (e.g., 32-bit unique salt on the passwords), the only time those passwords can effectively be checked is when the users set them. An "unbreakable password" 10 years ago is probably quite broken today. Users should still be changing passwords but it should be on their terms.
