There are recommendations to change passwords regularly mostly out of mindless repetition of a poorly understood practice from much older times in a different context.
Initially, passwords were something for the military; every single fort or camp used a "password" that soldiers had to know in order to enter the camp. We have indications that such a system was generalized in the Roman army, more than 2000 years ago.
Since such a password was, by construction, known to several people (at least the guards at the camp entrance, and every soldier who had business outside of the camp, e.g. to go fetch wood or water), and also uttered regularly and thus possible prey to spies with good ears, it was assumed that such a password would not remain secret for long. In fact, one could rationally expect that at any time, some enemies would know the passwords. The passwords were just a mitigation feature meant to delay covert entrance by enemies, rather than a reliable way to block them. The effectiveness of a given password steadily dropped over time, within a few hours, and thus had to be renewed daily.
Then the context changed. Nowadays, you use your password to authenticate yourself on a computer. There still are enemies, and they still want to learn your password. However, a very important part of the situation has changed a lot: you are, by construction, the only person who knows your own password. This is the normal, expected situation. On average, there is no leak at all. Your password is not shared. Therefore, the effectiveness of your password, which really is its secrecy, does not decrease over time -- it may drop to zero if the attacker succeeds at learning it, but as long as this does not happen, the password is as good as new.
Another context property which changed a lot is what attackers do when they learn a user's password. In the old Roman camp setup, the attacker would enter the camp, roam about it to try to gather intelligence (e.g. by listening around the centurion's tent), and possibly indulge in some casual sabotage, such as setting fire to supplies. This takes time. In a whole night, a spy can do some substantial damage, which is why there were extra mitigation features (other sentinels, rules against loitering within the camp, curfew, and so on). The regular password renewal forces the attacker to reacquire the new password while he tries to spread havoc. In our modern computer world, things don't go that way. The attacker will plunder your files and accounts, read and send emails, and generally enact his mischiefs within a few seconds because all of this can be automated to a great extent.
Forcing frequent user password renewal is a common practice of sysadmins, but it is misguided. Forcing your users to change their passwords every 42 days (that's the default value in Windows / Active Directory) makes sense only if we assume that the two following properties hold:
- On average, at any given time, a non-negligible proportion of user passwords are known to evil outsiders.
- Attackers loiter in the systems for weeks, and forcing a password renewal is a substantial hindrance to their nefarious schemes.
In reality, neither property holds. The forced password renewal, thus, does not yield its alleged benefits.
On the other hand, forced password renewal weakens security:
- Users must generate and remember new passwords, which is harder, and promotes behaviours which are detrimental to security, such as writing the passwords down on pieces of paper, or sharing the passwords with colleagues.
- The rate of "forgotten passwords" will be higher, increasing the workload of help desks. These, in turn, will react by lowering their identification standards, making them more vulnerable to social engineering.
- Users will not like it, and they will be more inclined to see the sysadmin as a control freak, to be avoided or circumvented, rather than a helpful friend whose warnings should be heeded. Most of practical security relies on voluntary cooperation from the user base, and any unexplainable constraint on their daily work will severely damage their willfulness to cooperate.
To sum up, there are recommendations about password change out of misguided tradition. It is one of the myths which float around in the field of IT security, because sysadmins are people, and like all their other fellow humans they prefer to apply so-called "best practices" rather than making the effort to sit down and think.
The problem is inflated by how innovation is rewarded: in the field of security, innovation is tracked down, pursued, cornered and ignominiously slaughtered. If a sysadmin does "what everybody else does" and a problem occurs nonetheless, then he will not be blamed. However, if a sysadmin does a smart but novel thing, then he cannot expect any thanks; in fact, if an attack succeeds despite the novel system, the innovator will become the scape goat for the whole business.
You can read some other opinions on this subject in this past question.
