Think changing your password every few months keeps you safe? Think again. Security experts killed the 90-day password reset about a decade ago for a reason—but many IT departments didn’t get the memo. Here’s why your office’s favorite policy is often doing more harm than good.