[__egb__]

> Also worth pointing out that NIST doesn't set policy…

Which has a side effect of NIST not even following its own guidance!

[rsfern]

For this particular issue, it took a while but the NIST password policy does follow 800-63 now. They changed it a while back.