According to Gregory Evans, every one should change their passwords every 3 months.