https://nakedsecurity.sophos.com/2016/08/18/nists-new-password-rules-what-you-need-to-know/