> "When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list of known commonly-used, ex

> "When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list of known commonly-used, expected, and/or compromised values." This has to be applied to the whole password (which it implies anyway) or you end up with the rather silly situation which I encountered the other day when I had to create a temporary password for a Microsoft service. It absolutely refused to accept even a very secure password if there was a portion that was not secure. For example: a password similar to "$4(password(!monsT3rDiet%@" was rejected. But if I removed the word "password" and made the string shorter (and therefore less secure), that was okay!