https://pages.nist.gov/800-63-3/sp800-63b.html#sec4



NIST Special Publication 800-63BNIST Special Publication 800-63Bpages.nist.gov


미국 국립 표준 기술 연구소 자료 중 하나


Verifiers SHOULD offer guidance to the subscriber, such as a password-strength meter [Meters], to assist the user in choosing a strong memorized secret. This is particularly important following the rejection of a memorized secret on the above list as it discourages trivial modification of listed (and likely very weak) memorized secrets [Blacklists].

비밀번호 설정할 때, 강도 측정기 제공해라

Verifiers SHALL implement a rate-limiting mechanism that effectively limits the number of failed authentication attempts that can be made on the subscriber’s account as described in Section 5.2.2.

로그인 시도 횟수 속도를 제한하는 효과적인 알고리즘 짜라

Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.

특수문자 강제로 넣게 하지 마라

연속적으로 반복되는 문자 넣어도 된다

비밀번호 주기적으로 변경하게 하지 마라



Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This facilitates the use of password managers, which are widely used and in many cases increase the likelihood that users will choose stronger memorized secrets.

비밀번호 관리자 기능을 사용할 수 있게 붙여넣기 허용해라