Frequency of password change

[Gene Spafford <spaf () CERIAS PURDUE EDU>]

I know this has been a topic here before, but I failed to archive the
info.  Does anyone have references to any good studies that show that
changing passwords once a month (or every 8 weeks, etc) is too
FREQUENT and leads to more cases of people forgetting passwords,
picking trivial passwords, writing them down, etc.

Thanks,