2 ms·
My guess would be that by "government standards" they were referring to PCI-DSS (actually an industry group standard), which in the current version requires pas
by jcrawfordor 12y ago
My guess would be that by "government standards" they were referring to PCI-DSS (actually an industry group standard), which in the current version requires passwords of at least 7 characters and with at least letters and numbers (PCI-DSS v3.0 8.2.3).
...However, the standard explicitly permits any other password requirement of the same or greater entropy.
...However, these requirements do not apply to consumer accounts at all (!). As far as I can tell, PCI-DSS actually has no requirements whatsoever for safeguarding of consumer user accounts. The more you know, the more you worry.