4 ms·
Quoting: When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains value
by jupp0r 7y ago
Quoting:
When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised. For example, the list MAY include, but is not limited to:
- Passwords obtained from previous breach corpuses.
- Dictionary words.
- Repetitive or sequential characters (e.g. ‘aaaaaa’, ‘1234abcd’).
- Context-specific words, such as the name of the service, the username, and derivatives thereof.
[1] https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html
- dllthomas 7y agoIf I read that correctly, it's about comparing the entire password, not portions thereof, so it's not really about "multiple English word" passwords (except that I assume "passwords obtained from previous breach corpuses" is likely to contain some specific examples of the breed, almost certainly including "correct horse battery staple").