3 ms·
> * Require more than 8 characters If I'm reading this right, it's more than 7 characters. And more than 5 if you don't let users pick the password, which seem
by ben0x539 5y ago
> * Require more than 8 characters
If I'm reading this right, it's more than 7 characters. And more than 5 if you don't let users pick the password, which seems surprising.
> Memorized secrets SHALL be at least 8 characters in length if chosen by the subscriber. Memorized secrets chosen randomly by the CSP or verifier SHALL be at least 6 characters in length and MAY be entirely numeric.
- beermonster 5y agoYou’ve read it correctly. The idea is to mitigate against brute force by account lockout/disable following N failed attempts rather than enforcing greater password length or complexity requirements.