search

anvilresearch / connect

A modern authorization server built to authenticate your users and protect your APIs
http://anvil.io
MIT License
361 stars 86 forks source link

Password validation fails for strong password #358

Open PetrSnobelt opened 7 years ago

PetrSnobelt commented 7 years ago

Hi, I try register user with password aaaaBBCB7C and it fails with "Password must be complex" message. But when I try it in onlinedemo on http://mel.lt/ it returns The password you entered is decent. Mellt estimates 159 days to crack

What's wrong? My config don't contain daysToCrack value and I using version: 0.1.59

christiansmith commented 7 years ago

I'm guessing our default daysToCrack value is a little aggressive. It defaults to 14, which doesn't seem to correspond to any estimate for a given password. Try a smaller value in your config.

PetrSnobelt commented 7 years ago

Hi Christian, on metl homepage it estimate 159 days which is much higher then default 14, isn't it?

I'm fine with 14 days, but in my UI I use metl directly for quick response and this password pass, but when I send it to anvil it fails.

christiansmith commented 7 years ago

Confusing as it is, I'm not sure there's a direct relationship between this configurable threshold and their estimate of how long a given password should take to crack.

tomec-martin commented 7 years ago

It seems to be a bug in node.js version of mellt. I have filled issue https://github.com/ravisorg/Mellt/issues/10