In many places, there's a policy that force the user changing it's password once a few months. The logic here is, that even if the password have leaked somehow, it'll be abused only for a relatively short period of time. So that a note with your password you threw to your bin now, will not come and hunt you in five years.
But what this policy is missing IMHO is, the people factor. What many people usually do when forced to change their password, is to choose a new password not to too far from the original one. Since it's hard to memorize the new password every month. For example
or so. So an attacker with a minimal amount of sense, would activate john-the-ripper or equivalent, and find out your password in no time. Heck, the entropy of the new password given the old password is typically so low, so that you can even bypass a password system that alerts the admin if you entered the wrong password three times in a row. You'll probably find the new one within 10 trials, and given that the user logs in once a day an attack will be able to find it out within a month.
So I'm asking, will a policy that force users to change their password once in a while actually provides more security than its cost?