Note from the author: While writing this blog post I ran into a client where I needed to spray against the Office365 portal hosted by Microsoft directly and wrote some code to do so. If you just want to read that bit, skip to the end.
If you’re reading this, it’s very likely that you know how to use the internet. It’s also likely you’ve made an account on the internet somewhere. When you created your last account, what kind of requirements were you forced to use? For a number of web services, these requirements still follow the 2003 NIST SP 800-63 Appendix A standards that recommend an 8-character minimum, containing one uppercase, one lowercase, one digit, and one special character (Ex: Procircular1!).