NIST’s second draft of its “SP 800-63-4“—its digital identify guidelines—finally contains some really good rules about passwords.