Whoever came up with the idea that passwords need to be regularly changed must be shot because no one has ever proved it makes any sense.
What it actually does is that people write passwords everywhere (papers, text files, etc), thus actually lowering their security.
- ssh did not exist or was not widely used. People used telnet, ftp, rlogin, etc. which put plaintext passwords on the wire.
- UNIX systems that used NIS distributed the password file to clients via a plaintext map which could be obtained by anyone with “ypcat passwd”. Many passwords were guessed in seconds using crack or John the ripper. Complex passwords would withstand those attacks for weeks or months with those tools using a single computer to reverse them.
- (I think) NTLM and CIFS authentication put password hashes over the wire. Various tools were available to reverse these as well. Once it was feasible to build rainbow tables, getting a password from a hash was a simple lookup.
- switched networks were not widely used making sniffing passwords or hashes from the wire much easier. Hubs would broadcast all traffic from all ports to the other ports on the hub. Coaxial Ethernet daisy chained many computers along the same physical wire. I think that “ring” networks (token ring, fddi) also passed all traffic by all nodes.
In those days, regular password changes were important because your password it it’s hash was regularly exposed.
I’d argue that today, any password you type where someone else may have a camera should be treated as though it has also been compromised. This means that if your password manager isn’t auto filling it, you should be using that password only with two factor authentication.
(edit: formatting, auto-carrot)