4 ms·
This is what we do at my place of work. Minimum 8 characters - and the password cannot appear as one of the top compromised passwords in HIBP list. Except in F
by jhgg 4y ago
This is what we do at my place of work. Minimum 8 characters - and the password cannot appear as one of the top compromised passwords in HIBP list.
Except in France - CNIL does not agree with NIST. :(
- seszett 4y agoI'm not sure exactly in what they don't agree with NIST in your mind but CNIL recommends minimal entropy rather than minimum length (without "special characters, numbers, etc" restrictions), also recommends checking against a blacklist and above all that recommend using other methods than password authentication when possible. That doesn't strike me as incompatible with NIST recommendations.