Screen Passwords According to
NIST Password Recommendations
NIST 800-63B recommends checking new passwords against those used in cybercriminal dictionary attacks:
Ready to start screening passwords?
Why is NIST recommending this new approach?
The NIST password recommendations include this type of screening because it matches the methods used by cybercriminals in modern brute force attacks.
It’s become clear that people, if unchecked, follow very common patterns in password selection. As a result, cybercriminals use lists of common passwords and patterns found in previous breaches to narrow the universe of passwords attempted in their attacks. Guessing passwords becomes easier when the actual set of passwords is predictable.
NIST 800-63B section 5.1.1 explains the objective:
The NIST recommendation is to screen for commonly used and compromised passwords to prevent people from selecting these easy to guess passwords.
To satisfy this objective, PasswordPing continuously collects compromised passwords and aggregates cracking dictionaries to create a comprehensive blacklist of unsafe passwords. Our list contains over 1.8 billion entries. It includes every word from every Wikipedia article in all languages and every clear text password from over 3,000 data breaches.
While this black list continues to evolve, the rate at which new unique entries are being added has dramatically slowed giving us confidence that we’ve captured a nearly complete universe of the common passwords used by hackers.