Forced password changes are the biggest downside I've run into... I had to resort to a modified algorithm when LinkedIn was hacked, for instance. But for 90%+ of the websites I use it on, especially social networks and forums and the like, it's hardly ever an issue.