Just recently Estonian Information System Authority published a new report (including new guidelines for passwords) basically telling: "Drop password requiremen

Just recently Estonian Information System Authority published a new report (including new guidelines for passwords) basically telling: "Drop password requirements, allow long passwords and restrict the use of short and top-n passwords". Why I'm mentioning this is because now I have an actual official document I can send to Estonian companies in addition to my own words (that weren't previously believed, ugh) why their requirements are inane. I think this kind of behaviour shows that we actually need some kind of monitoring or regulation here to build more secure software for everyone. Also as you mentioned bad-"strong" passwords, I "love" how something like "Qwerty!1234" satisfies most requirements but "8f434346648f6b96df89dda901c5176b10a6d83961dd3c1ac88b59b2dc327aa4" is not okay because it doesn't contain an uppercase letter or a symbol.