search

ToastWallet / core

This repo contains the core code for Toast Wallet. It is built for iOS, Android and browser directly from this repository. PC builds are built from the browser version using Electron.
GNU General Public License v2.0
210 stars 80 forks source link

Propose removing arbitrary password rules. #26

Open internalfx opened 6 years ago

internalfx commented 6 years ago

NIST’s new password rules

No composition rules. What this means is, no more rules that force you to use particular characters or combinations, like those daunting conditions on some password reset pages that say, “Your password must contain one lowercase letter, one uppercase letter, one number, four symbols but not &%#@_, and the surname of at least one astronaut.”

Let people choose freely, and encourage longer phrases instead of hard-to-remember passwords or illusory complexity such as pA55w+rd.

https://blog.codinghorror.com/password-rules-are-bullshit/

ToastWallet commented 6 years ago

Hi Bryan

Thanks for the pull request.

Entering passphrase on mobile is a pain. Shorter passphrase with a greater complexity is advantageous in this setting. But I agree it makes it more likely that users will forget their passphrase, and also more likely users will pick short passphrase they merely think are complex when they aren't.

Rather than remove the other rules and replace them with a minimum 10 char length, it might be better to come up with an algorithm to test complexity (or find an existing one that isn't too heavy weight). Then according to that algorithm we will let them set the requested passphrase or not. So a short passphrase with high complexity would pass, as would a long phrase with low complexity, but a short passphrase with low complexity would fail.

Interested to see what you come up with!

internalfx commented 6 years ago

Complexity is not a metric we should measure. That is part of the problem with the way most of us (including me at one time) used to think about password security.

The fact is...

Complexity != Security

So we should measure for security not complexity, and anything under 10 chars (depending on slowness of the algorithm) is inherently insecure.

I think we should also check against leaked password lists if we want to be more proactive. But "composition rules" need to go, and short passwords do too.

https://nakedsecurity.sophos.com/2016/08/18/nists-new-password-rules-what-you-need-to-know/

ToastWallet commented 6 years ago

Sorry let me clarify: when I say complexity I actually mean entropy per character taking into account password lists and common brute force techniques. This is what I think we should measure.

internalfx commented 6 years ago

Sounds like we're on the same page.

Have you considered zxcvbn?

https://github.com/dropbox/zxcvbn

ToastWallet commented 6 years ago

Looks like exactly what we need thanks!