In an internationalized application, what is the best practice for a policy on complexity of passwords? I am not having luck searching for the answer. Wikipedia lists these items for password policy:
- the use of both upper- and lower-case letters (case sensitivity)
- inclusion of one or more numerical digits
- inclusion of special characters, e.g. @, #, $ etc.
- prohibition of words found in a dictionary or the user's personal information
- prohibition of passwords that match the format of calendar dates, license plate numbers, telephone numbers, or other common numbers
- prohibition of use of company name or an abbreviation
If I am a non Latin based language speaker, how do rules about upper and lower case work? It's not as simple as a-z and A-Z. What about dictionary lookups and prohibiting certain formats? This problem seems well know for English, but what about other languages and cultures?