> It’s very likely that a lot of your user’s passwords are going to be cracked
While I agree that peppering your passwords is good practice, this is just flat-out wrong - with a salted modern hash algorithm it should be cryptographically infeasible to crack passwords from a database dump, and if you are using an insecure algorithm, it is just as easy to recover the pepper as the passwords.
> Very few will make any mention to how password policy plays a significant part in ensuring the security of any stored values.
As a reminder, the NIST recommends enforcing only minimum length and known-vulnerable password requirements: "Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets." [1]
While I agree that peppering your passwords is good practice, this is just flat-out wrong - with a salted modern hash algorithm it should be cryptographically infeasible to crack passwords from a database dump, and if you are using an insecure algorithm, it is just as easy to recover the pepper as the passwords.
> Very few will make any mention to how password policy plays a significant part in ensuring the security of any stored values.
As a reminder, the NIST recommends enforcing only minimum length and known-vulnerable password requirements: "Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets." [1]
[1] https://pages.nist.gov/800-63-3/sp800-63b.html#sec5