your password requirements for new users are annoying and put you in a bad light #173

joernhees commented 2020年04月26日 21:52:53 +02:00

Your sign up currently seems to require pws to be no less than 6 chars long and have the following requirements:

Password does not pass complexity requirements:
At least one special character (punctuation, brackets, quotes, etc.)
At least one lowercase character
At least one uppercase character
At least one digit

So you're telling new users to trust your platform with their code, but during the sign up process you imply that you that aaaA1. is more secure than a standard pwgen 20 (e.g., Nue0gaev3nooGoh5ahph)?

https://xkcd.com/936/

Your [sign up](https://codeberg.org/user/sing_up) currently seems to require pws to be no less than 6 chars long and have the following requirements: Password does not pass complexity requirements: At least one special character (punctuation, brackets, quotes, etc.) At least one lowercase character At least one uppercase character At least one digit So you're telling new users to trust your platform with their code, but during the sign up process you imply that you that `aaaA1.` is more secure than a standard `pwgen 20` (e.g., `Nue0gaev3nooGoh5ahph`)? https://xkcd.com/936/

hw commented 2020年04月27日 21:30:30 +02:00

There is an ongoing discussion in https://github.com/go-gitea/gitea/issues/11177 suggesting to add a NIST compliant entropy checker which we would very much endorse.

Do you think you could possibly contribute to bring the implementation of this feature forward?

There is an ongoing discussion in https://github.com/go-gitea/gitea/issues/11177 suggesting to add a NIST compliant entropy checker which we would very much endorse. Do you think you could possibly contribute to bring the implementation of this feature forward?

ousia commented 2020年04月28日 10:17:06 +02:00

Sorry, but how about enabling Unicode support in passwords?

I’m just an average user (I don’t code), but this would make easier for user to create much more complex passwords.

Sorry, but how about enabling Unicode support in passwords? I’m just an average user (I don’t code), but this would make easier for user to create much more complex passwords.

BoilingOil commented 2020年06月13日 08:11:38 +02:00

I think the password requirement is smart. Actually, all my passwords are between 16 and 24 chars long, and contain at least two distinctly different of each. I'm actually annoyed if I sign up somewhere where they trip over special chars, or can't handle more than eight characters. No, STEAM pisses me off with their weird practices. But let's not get off topic.

I think the password requirement is smart. Actually, all my passwords are between 16 and 24 chars long, and contain at least two distinctly different of each. I'm actually annoyed if I sign up somewhere where they trip over special chars, or can't handle more than eight characters. No, STEAM pisses me off with their weird practices. But let's not get off topic.

polychromata commented 2020年06月26日 03:42:40 +02:00

These requirements should definitely be dropped. They don't reflect how password strength works.

If you want to require passwords to be secure, use zxcvbn to measure password strength, and require passwords to score at least 2/4 or whatever.

These requirements should definitely be dropped. [They don't reflect how password strength works.](https://xkcd.com/936/) If you want to require passwords to be secure, use [zxcvbn](https://github.com/dropbox/zxcvbn) to measure password strength, and require passwords to score at least 2/4 or whatever.

hw commented 2020年06月26日 08:19:03 +02:00

This one looks like still waiting for a contributor, the issue is also frequently discussed in the gitea issue tracker? PR to gitea welcome!

This one looks like still waiting for a contributor, the issue is also frequently discussed in the gitea issue tracker? PR to gitea welcome!

BoilingOil commented 2020年06月26日 10:00:17 +02:00

These requirements should definitely be dropped.

Well, I'll agree that:

Password does not pass complexity requirements:

At least one special character (punctuation, brackets, quotes, etc.)
At least one lowercase character
At least one uppercase character
At least one digit

is a little simplistic. The principle is alright, but it would be a lot better if the above was part of a broader definition, like:

• must be at least 8 characters long
• should not contain any common words like the login name, email address, or the word "password"
• ... come up with some rules yourself to expand this...

However, one must also realize that the above only comes up if an already attempted password did not meet at least these minimum requirements, meaning that at least one of the four categories is not represented at all!

> These requirements should definitely be dropped. Well, I'll agree that: > Password does not pass complexity requirements: > At least one special character (punctuation, brackets, quotes, etc.) > At least one lowercase character > At least one uppercase character > At least one digit is a little simplistic. The principle is alright, but it would be a lot better if the above was part of a broader definition, like: * must be at least 8 characters long * should not contain any common words like the login name, email address, or the word "password" * ... come up with some rules yourself to expand this... However, one must also realize that the above only comes up if an already attempted password did not meet *at least* these minimum requirements, meaning that at least one of the four categories is not represented at all!

lhinderberger commented 2020年08月28日 14:52:25 +02:00

Strong passwords are important, but probably equally important is a second factor for authentication.

We should advertise that possibility right in our UI when creating new accounts, if possible (I'm already putting it in the Getting Started guide, but I guess most people will figure out how to create an account themselves and thus not read that article).

Apart from that we should also point out the password policy clear in the registration UI (even better: validate it without a round-trip to the server), because it's frustrating to need to re-generate an otherwise perfectly valid password just because it's missing special characters and to have a second round-trip of the registration form because of that.

Strong passwords are important, but probably equally important is a second factor for authentication. We should advertise that possibility right in our UI when creating new accounts, if possible (I'm already putting it in the Getting Started guide, but I guess most people will figure out how to create an account themselves and thus not read that article). Apart from that we should also point out the password policy clear in the registration UI (even better: validate it without a round-trip to the server), because it's frustrating to need to re-generate an otherwise perfectly valid password just because it's missing special characters and to have a second round-trip of the registration form because of that.

hw commented 2020年08月28日 19:22:12 +02:00

Maybe even have some (not too invasive?) banner to remind+encourage enabling 2FA?

Maybe even have some (not too invasive?) banner to remind+encourage enabling 2FA?

hw commented 2020年08月28日 19:22:24 +02:00

some thing like "did you know ...?"

some thing like "did you know ...?"

n commented 2020年09月16日 16:21:31 +02:00

Codeberg/build-deploy-gitea#39 disabled the password complexity requirements and increased the minimum password length from 6 to 8 characters. This issue can be closed now.

Codeberg/build-deploy-gitea#39 disabled the password complexity requirements and increased the minimum password length from 6 to 8 characters. This issue can be closed now.

lhinderberger commented 2020年09月16日 16:44:15 +02:00

@n Would you prefer moving the discussion about a 2FA reminder to a new issue or to rename this issue and leave it open for now? (I'd personally prefer the former)

@n Would you prefer moving the discussion about a 2FA reminder to a new issue or to rename this issue and leave it open for now? (I'd personally prefer the former)

n commented 2020年09月17日 14:35:46 +02:00

I'd prefer opening a new issue, since the annoying password requirements has been resolved.

I'd prefer opening a new issue, since the annoying password requirements has been resolved.

lhinderberger commented 2020年09月17日 18:09:34 +02:00

Okay, then let's move discussion to #279 :)

Okay, then let's move discussion to #279 :)