We should require users to change their passwords every year. Send them mails 40 days before their account is temporarily deactivated (i.e. login disabled) to request them to change their password. If they don't do it, their login won't work anymore and we should automatically send them a mail (upon login) such they can reset their password (and show that in the UI via an alert).
We should require users to change their passwords every year. Send them mails 40 days before their account is temporarily deactivated (i.e. login disabled) to request them to change their password. If they don't do it, their login won't work anymore and we should automatically send them a mail (upon login) such they can reset their password (and show that in the UI via an alert).