Hacker News Reader

Yes. Very often, administrators and victims do not know when their password is compromised. The policy of changing it is to cut present access off from those who already obtained it. It is just an additional safeguard over intrusion detection systems.

I always related it to the military practice of issuing new codebooks periodically. For one concrete example, the Japanese changed their codes right before the Battle of Midway, so the US was not able to under any of the messages sent during the battle. Unfortunately for the Japanese, the US already had enough information from cracking the former Japanese code that this really did not matter.

The only reason you would want to do this is if you use the same password for multiple things. You may have signed up with some website a year ago, used it once and then forgot all about it. If they get compromised you might not even know it.

If you change your passwords often then you don't need to worry about this as much.