“The NIST standard is saying don't do that anymore.”

Transcript evidence from Chris and Robert -- Passwords, Identity, and #AppSec.