Password complexity question

[StoopidGit]

Hi All,

In ASVS, 2.1.1. states:

• "Verify that user set passwords are at least 12 characters in length (after multiple spaces are combined).

However, in the OWASP Cheat Sheet on AuthN it states:

• Minimum length of the passwords should be enforced by the application. Passwords shorter than 8 characters are considered to be weak (NIST SP800-63B).

Can someone help to clarify the difference as well as which guidance is best?

[elarlang]

Please always watch latest requirement, and that is at the moment:

V2.1.1 Verify that user set passwords are at least 8 characters in length although a minimum of 15 characters is strongly recommended.

[StoopidGit]

Ah, that's why I didn't see. Thank you again!

[StoopidGit]

do you know about when v5.0 would release?

[elarlang]

"Hopefully in some months" is the most precise promise I can give

[StoopidGit]

Hey @elarlang, is there training for ASVS that I can take back with me to my company? Or are you (or any of the other authors) available for booking?

[elarlang]

Not sure what is the expected outcome for "training for ASVS". Many co-leaders provide security trainings one way or another, but as those may be not under OWASP umbrella, I don't think it is a nice gesture to advertise those here.