News for hackers. Stuff that matters.
Re:SaaS CTO Security Checklist by jupp0r on Thursday May 30, 2019 @05:46PM (#20056220)
Quoting:

When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised. For example, the list MAY include, but is not limited to:

- Passwords obtained from previous breach corpuses.

- Dictionary words.

- Repetitive or sequential characters (e.g. ‘aaaaaa’, ‘1234abcd’).

- Context-specific words, such as the name of the service, the username, and derivatives thereof.

[1] https://pages.nist.gov/800-63-3/sp800-63b.html

Re:SaaS CTO Security Checklist by dllthomas on Thursday May 30, 2019 @06:26PM (#20056558)
If I read that correctly, it's about comparing the entire password, not portions thereof, so it's not really about "multiple English word" passwords (except that I assume "passwords obtained from previous breach corpuses" is likely to contain some specific examples of the breed, almost certainly including "correct horse battery staple").