Conversation

There's some good advice in here about what *not* to do with passphrase policies for online services, and why, with some potentially helpful references. But ultimately I disagree with a lot of Troy's conclusions, because they're biased by what kind of US makes sense to him, a power user with a high level of security knowledge, not a #JoUser. My favourite approach is what #Medium does; they send a login link to your registered email address instead of storing a password.
https://www.troyhunt.com/passwords-evolved-authentication-guidance-for-the-modern-era/