3 ms·
The modern government standard for classified systems is 15 characters minimum.
by ryan-c 12y ago
The modern government standard for classified systems is 15 characters minimum.
- jcrawfordor 12y agoMy guess would be that by "government standards" they were referring to PCI-DSS (actually an industry group standard), which in the current version requires passwords of at least 7 characters and with at least letters and numbers (PCI-DSS v3.0 8.2.3). ...However, the standard explicitly permits any other password requirement of the same or greater entropy. ...However, these requirements do not apply to consumer accounts at all (!). As far as I can tell, PCI-DSS actually has no requirements whatsoever for safeguarding of consumer user accounts. The more you know, the more you worry.