Minimum Password Length

[whitehacklabs]

Why ASVS V4 requires 12 character password length while NIST SP800-63b requires 8

[jmanico]

We are going with other industry guidance. This is the one area we deviated SP800-63b on purpose. If this harms your efforts we advise forking the standard. Frankly ASVS is more of a framework than a standard and we encourage forking for individual needs!

…

-- Jim Manico @manicode

On Apr 9, 2020, at 8:09 AM, WhiteHackLabs ***@***.***> wrote:  Why ASVS V4 requires 12 character password length while NIST SP800-63b requires 8 — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or unsubscribe.

[whitehacklabs]

Thanks