Microsoft says mandatory password changing is “ancient and obsolete”.

Link. New problem: passwords must be tappable so can’t be random.