search

arachne-threat-intel / thread

Thread is a tool for analysts to map finished reports and articles to MITRE ATT&CK®.
https://arachne.digital/thread
Apache License 2.0
4 stars 3 forks source link

.digital Email Login Error #115

Open twentysixmoons opened 1 month ago

twentysixmoons commented 1 month ago

Describe the bug The Thread login seems to not allow for the "arachne.digital" email address when creating an account. I got an error a few times that said, "The password is too similar to the email," until I used an email address ending in .co.

To Reproduce Steps to reproduce the behavior:

  1. Go to 'https://arachne.digital/account/login/'
  2. Click on 'Click on sign-up'
  3. Land on 'https://arachne.digital/account/register/'
  4. Input username
  5. Input email address ending in 'arachne.digital'
  6. Input passwords
  7. Agree to terms and services
  8. Click 'submit'
  9. See error

Expected behavior The account to have been created.

Screenshots If applicable, add screenshots to help explain your problem.

Screenshot 2024-07-31 at 5 09 47 PM

Thread details (please complete the following information): I don't know what this means.

  • config.yml changes
  • Tagged-version used or output of git rev-parse --short HEAD

Desktop (please complete the following information):

Additional context Add any other context about the problem here.

KadeMorton commented 1 month ago

To cover off our conversation, I've asked @jecarr to have a look at this ticket so we should be onto this soon!

jecarr commented 1 month ago

Hi @twentysixmoons - sorry to hear you encountered these issues and thank you for raising a bug report.

I was unable to replicate this locally; I triggered the error when I used a password that was similar to the email address (as the error message you received states). This is intentional as we have these restrictions to encourage the use of strong passwords. From the video below, I was unable to replicate this with other varied passwords.

Please do let us know if this was not the case for you when you encountered this issue (i.e. you did input passwords that actually were not similar to your email address at all). If you would like to reply to us saying as much, I would advise letting us know the passwords you attempted to use so we can try and replicate this. Ideally do this in a private manner (Slack/email).

However, if you are able to review the passwords you attempted and recognise (similarly to the video) that the error-message correctly is flagging similarities between those passwords and the .digital email address you provided, then we will proceed with closing this ticket.

Screencast from 13-08-24 19:02:53.webm

jecarr commented 1 month ago

@KadeMorton

Thread details (please complete the following information): I don't know what this means.

Let's update our Issue-Template to state something like "if using a dev/local/non-live version..."

jecarr commented 3 weeks ago

Hi @twentysixmoons

Thanks for following up with me on this with an example password you attempted. I was able to see why you are receiving this error.

Outside of these comments here, I will discuss with @KadeMorton the fix for this (as this means looking at code outside Thread's codebase). I will additionally contact you outside these comments. This will be regarding consent for the example password you provided to be shared with Kade as evidence for why and how particular changes need to be made.

I'll keep this issue open as discussions will be ongoing.