> But they're not checking length. Yeah, for that you'd need to know more about the password than we'd like them to know. I imagine they are simply setting the

> But they're not checking length. Yeah, for that you'd need to know more about the password than we'd like them to know. I imagine they are simply setting the policy to "double" the password if it is older than X days.