Travel to some other side of the world and France's CNIL recommends[0] the following password rules as of 27 Jan 2017 (abridged): - if the system uses a login

Travel to some other side of the world and France's CNIL recommends[0] the following password rules as of 27 Jan 2017 (abridged): - if the system uses a login + password scheme: 12 chars min and mandatory mix of all among non-caps/caps/digit/special - if the system uses a login + password + time-based exponential backoff rate limiting with a baseline of 1 min after 5 tries maxxing at 25 per 24h or lockout after 10 tries or a bot detector such as captcha: 8 chars min and mandatory mix of 3 among non-caps/caps/digit/special - if the system uses login + password + environmental information (such as IP or MAC addr, etc...) + time-based exponential backoff rate limiting with a baseline of 1 min after 5 tries maxxing at 25 per 24h or lockout after 5 tries or a bot detector such as captcha: 5 chars - if the system uses login + password + hardware second factor (SIM, U2F, YubiKey...) + lock out after 3 tries: 4 chars To fend off in-transit and offline attacks, the document suggests that auth should transit sufficiently encrypted (using a cipher or method currently recognised as strong and non-vulnerable) and passwords should be stored obfuscated using a secure (similarly defined as strong and non-vulnerable) one-way cryptographic function with salt (and possibly pepper since they mention a "key", which makes no sense for one-way crypto functions). [0]: https://www.legifrance.gouv.fr/affichTexte.do;jsessionid=DCFF485B7666F100CC93BF17B5D6BB27.tpdila17v_1?cidTexte=JORFTEXT000033928007&dateTexte=&oldAction=rechJO&categorieLien=id&idJO=JORFCONT000033926715 https://www.legifrance.gouv.fr/affichTexte.do;jsessionid=DCF...