3 ms·
Yes, if you’re not actually doing the “compare password against breach lists” part of SP 800-63B regularly they likely won’t accept it. I hope forced expiry wi
by tatersolid 7y ago
Yes, if you’re not actually doing the “compare password against breach lists” part of SP 800-63B regularly they likely won’t accept it.
I hope forced expiry will be gone from next PCI revision anyway.
- alanning 7y agoDo you happen to have a library/tool you could recommend that helps with this or did you develop something in-house? My startup is implementing most of the NIST rec’s with the help of projects like zxcvbn but we would like to also start doing breach list comparisons so figured I’d ask.
- djhn 7y agoH8mail on Github and the APIs it connects to.
- tatersolid 7y agoWe use the NTLM version of the haveibeenowned lists plus a power shell script from https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Test-PasswordQuality.md https://github.com/MichaelGrafnetter/DSInternals/blob/master...