The article seems arising in reference to the NIST SP800-63-3 Digital Identity Guidelines, published June 22, 2017: https://pages.nist.gov/800-63-3/ https://pa

The article seems arising in reference to the NIST SP800-63-3 Digital Identity Guidelines, published June 22, 2017: https://pages.nist.gov/800-63-3/ https://pages.nist.gov/800-63-3/ Three highlights of NIST SP800-63-3, from the SANS Security Awareness blog: "For years people like Per Thorsheim, Cormac Herley and Dr. Angela Sasse have fought against this. Finally these painful behaviors are being put to rest by NIST in their official publication SP800-63-3 Digital Identity Guidelines. While a rather large series of documents, they have a couple key points about passwords, specifically in sections 5.1.1.1, 5.1.1.2 and Appendix A. Long story short. * Entropy is dead, focus on password length. Stop inflicting complexity requirements, instead long live the passphrase. * Only change passwords if you are concerned it may have been compromised. * SP800-63-3 specifically states systems should support the use of password managers." https://securingthehuman.sans.org/blog/2017/07/27/nist-has-spoken-death-to-entropy-love-live-the-passphrase https://securingthehuman.sans.org/blog/2017/07/27/nist-has-s...