Document ID: chunk:federal_register_of_legislation:F2024L01435:reg:3
Version: federal_register_of_legislation:F2024L01435
Segment Type: reg
Provision Reference: reg 3
Character Range: 49213–50385

3                                a request from an individual is being processed to establish or change a memorised secret:  the ISP must compare the prospective secret against a list that contains secrets known to be commonly used, expected or compromised.
                                                                                                                             Example:  The list may include:
                                                                                                                                 * passwords obtained from previous breach corpuses;
                                                                                                                                 * dictionary words;
                                                                                                                                 * repetitive or sequential characters (e.g. "aaaaaa", "1234abcd"); and
                                                                                                                                 * context-specific words, such as the name of the service, the username, and derivatives thereof.