
Does the application enforce the use of secure passwords
-------

**Description:**

When an application does not enforce the use of secure passwords, 
these passwords could easily be brute-forced thus compromising the users account.

**Solution:**

The user should be enforced to use secure passwords. This can be done by using a 
passphrase policy. Also known top 1000 passwords should also be forbidden.

**NOTE:** Never put restrictions on the password the user submits. Some applications for 
instance do not allow passwords longer than twenty chars. This is an example of bad 
practise since the password must be allowed as strong as the users wants it to be.


	
