News for hackers. Stuff that matters.

A comment on I hate password rules. Parent comment

Re:I hate password rules by ben0x539 on Tuesday November 16, 2021 @03:03PM (#29245704)
> * Require more than 8 characters

If I'm reading this right, it's more than 7 characters. And more than 5 if you don't let users pick the password, which seems surprising.

> Memorized secrets SHALL be at least 8 characters in length if chosen by the subscriber. Memorized secrets chosen randomly by the CSP or verifier SHALL be at least 6 characters in length and MAY be entirely numeric.

[ Parent | on HN ]
Re:I hate password rules by beermonster on Tuesday November 16, 2021 @04:28PM (#29246555)
You’ve read it correctly.

The idea is to mitigate against brute force by account lockout/disable following N failed attempts rather than enforcing greater password length or complexity requirements.

[ Parent | on HN ]