This is a good summary of the NIST recommendations [1, Sec 5.1] found in [2]. Dropbox released a library [3] that's easy enough to configure to add your own bl

This is a good summary of the NIST recommendations [1, Sec 5.1] found in [2]. Dropbox released a library [3] that's easy enough to configure to add your own black list (e.g., your company name, your public wifi password, etc.) Finally, my recommendation is to enforce same password between laptop and web tools, and use SSO wherever possible. Password requirements: - 8-char minimum and 64-char maximum length - The ability to use all special characters but no special requirement to use them - Restrict sequential and repetitive characters (e.g. 12345 or aaaaaa) - Restrict context specific passwords (e.g. the name of the site, etc.) - Restrict commonly used passwords (e.g. p@ssw0rd, etc.) - Restrict passwords obtained from previous breach corpuses [1] https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html [2] https://spycloud.com/new-nist-guidelines/ https://spycloud.com/new-nist-guidelines/ [3] https://github.com/dropbox/zxcvbn https://github.com/dropbox/zxcvbn