mirror of
https://github.com/cypht-org/cypht.git
synced 2026-04-25 04:56:03 +03:00
[GH-ISSUE #93] Create a password restrictions module set #73
Labels
No labels
2fa
I18N
PGP
Security
Security
account
advanced_search
advanced_search
announcement
api_login
authentication
awaiting feedback
blocker
bug
bug
bug
calendar
config
contacts
core
core
devops
docker
docs
duplicate
dynamic_login
enhancement
epic
feature
feeds
framework
github
github
gmail_contacts
good first issue
help wanted
history
history
imap
imap_folders
inline_message
installation
keyboard_shortcuts
keyboard_shortcuts
ldap_contacts
mobile
need-ssh-access
new module set
nux
pop3
profiles
pull-request
question
refactor
release
research
saved_searches
smtp
strategic
tags
tests
themes
website
wordpress
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/cypht#73
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @jasonmunro on GitHub (Jun 28, 2016).
Original GitHub issue: https://github.com/cypht-org/cypht/issues/93
Originally assigned to: @Danelif on GitHub.
Some random thoughts of features worth supporting. This module set will only apply for sites using the built in user authentication and not pass-through to a mail service.
@dumblob commented on GitHub (Jun 28, 2016):
Good idea.
I must though disagree on several points from the proposal (yes, even NIST has it wrong :(). E.g.
min caps 1min puncuation 1min symbols 1are not useful (why is it so is explained under the linked sources on the zxcvbn gihub page I'm referring to below - e.g. remembering and writing symbols and lowercase/UPPERCASE is harder then having the password by 1 or 2 characters longer to achieve way higher security, because people then don't write down their passwords on papers glued to their LCDs, but rather remember them).For a good strength estimator please see https://github.com/aybabtme/zxcvbn and the literature and explanations linked from that page.
The rest of the proposal (including expiration) is a decent one, thanks!
@jasonmunro commented on GitHub (Jun 28, 2016):
Thanks for the feedback. It's all about entropy here. Unencumbered by facts, I'm not surprised having a larger overall minimum might outweigh forcing a larger character set. Honestly I like the pass-phrase approach the best. Max entropy, and a phrase that doesn't require a post-it :) Regardless, I plan on making each of these a knob a site can tune to whatever they want.
@dumblob commented on GitHub (Jun 29, 2016):
If it's not much more work, then it's undoubtedly the best solution.
@marclaporte commented on GitHub (May 7, 2024):
@Danelif please advise.
@marclaporte commented on GitHub (May 7, 2024):
If we do this, we should re-use an existing lib.
@Danelif commented on GitHub (May 7, 2024):
We might consider using the PasswordPolicy library. This library allows to define password policies (e.g. minimum length, required character types) and then hash and verify passwords against those policies. More information on this library https://github.com/web-token/jwt-password-policy
@marclaporte commented on GitHub (May 7, 2024):
https://github.com/web-token/jwt-password-policy gives me "page not found"
@Danelif commented on GitHub (May 7, 2024):
https://github.com/ircmaxell/password-policy
@marclaporte commented on GitHub (May 7, 2024):
Last commit 8 years ago
@IrAlfred commented on GitHub (Sep 26, 2025):
Hello @Danelif
Any update here ?
@Danelif commented on GitHub (Sep 26, 2025):
@marclaporte @IrAlfred what about this https://github.com/bjeavons/zxcvbn-php
Last commit is 7months old
If agreed, we can start its integration
@IrAlfred commented on GitHub (Sep 26, 2025):
@Danelif This is a good start.
To ensure we select the most effective solution, I recommend conducting a comparative analysis of available password validation libraries. This would involve evaluating key criteria such as security features, customization options, performance, and maintenance status to identify the optimal package for Cypht's specific requirements.
You can do this on a wiki page
@Danelif commented on GitHub (Sep 26, 2025):
@IrAlfred Got it
I put this on my TODOs
@marclaporte commented on GitHub (Sep 26, 2025):
Was done here: https://dev.tiki.org/Password-Strength-Implementation-Review
We should use the same for Cypht and Tiki
Tracked internally on https://avan.tech/item112169
@Danelif commented on GitHub (Sep 26, 2025):
Thank you @marclaporte
I will review and start implementation on Cypht and later in Tiki
@marclaporte commented on GitHub (Sep 27, 2025):
As discussed: let's put this on pause. Let's do in Tiki first.