Operative bit in 5.2.2: "Verifiers SHOULD NOT impose other composition rules (mixtures of different character types, for example) on memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically) unless there is evidence of compromise of the authenticator or a subscriber requests a change."
I'm cautiously hopeful that this will supply needed ammunition for those advocating for saner password rules and policies in organizations big and small.
I'm cautiously hopeful that this will supply needed ammunition for those advocating for saner password rules and policies in organizations big and small.