800-63-3 VS postmapweb

I see you got your regex, but please consider reading the nist guidelines https://pages.nist.gov/800-63-3/ It is an excellent resource in password policies that isn't shared nearly enough.

Even NIST outright recommends against SMS/phone 2FA.

ID.me is the first NIST 800-63-3 approved company. https://www.businesswire.com/news/home/20180816005147/en/ID.me-Becomes-First-Identity-Provider-to-Be-Approved-as-NIST-800-63-3-Conformant & https://insights.id.me/article/what-are-the-nist-800-63-digital-identity-guidelines/

NIST has made a series of sensible guidelines:

https://pages.nist.gov/800-63-3/

They now need to be made enforceable, whether by government requiring them in government contracts, or indirectly by insurers excluding coverage if they are not met.

I just tell our customer's compliance systems and vendors (there's usually a space to explain why you're not doing a given thing) that we'll start rotating passwords as soon as NIST recommends it (again) , and no sooner. Nobody has ever failed a test nor have I even been asked about this stance. Flies right under the radar.

Several hundred pages if you want to read it all - https://pages.nist.gov/800-63-3/.

I do the same using self-hosted email, and wrote a web UI for Postfix virtual domain management to streamline this:

https://github.com/fazalmajid/postmapweb

Yes. Apple and DuckDuckGo offer that as a feature. I use Postfix and wrote my own web UI to manage virtual domains: https://github.com/fazalmajid/postmapweb

It's very interesting seeing how companies get breached. The most common culprit is when they outsource email marketing to third-party firms with spotty security, but when I started receiving pornographic spam sent to my Dell vendor email address, I knew their security is worthless.

I've been doing this for 20 years now, and Apple or DuckDuckGo have made it accessible to normal people. The day I started receiving pornographic spam addressed to [email protected] (no longer the domain I use, BTW), I knew Dell's security was worthless and they had been breached.

BTW I build a simple spreadshee-like GUI for Postfix to manage the list, as it's grown quite large:

https://github.com/fazalmajid/postmapweb