Bookie currently accepts very short passwords

[bigblind]

The acceptable_password method currently accepts passwords that are longer than 3 characters with no further restrictions.

https://github.com/bookieio/Bookie/blob/develop/bookie/models/auth.py#L210

I'm currently working on a patch that will allow the minimum password length, and the types of characters that are required to be set in the settings. The problem is that I don't know enough about pyramid to know how to give the user a relevant error message.

So, can someone tell me where to start with flash message type things like this?

[mitechie]

On Sun, 16 Mar 2014, Frederik Creemers wrote:

The acceptable_password method currently accepts passwords that are longer than 3 characters with no further restrictions.

https://github.com/bookieio/Bookie/blob/develop/bookie/models/auth.py#L210

I'm currently working on a patch that will allow the minimum password length, and the types of characters that are required to be set in the settings. The problem is that I don't know enough about pyramid to know how to give the user a relevant error message.

So, can someone tell me where to start with flash message type things like this?

So the current password check takes place in a method called "acceptable_password" and the check is done:

https://github.com/bookieio/Bookie/blob/develop/bookie/views/auth.py#L204

I'd think we'd just update that method and update the message back.

I'd like to not get too carried away with complexity in the passwords. This is a list of people's bookmarks. We don't store private bookmarks yet, and I admit that will change, but even then it's not like we're storing anyone's bank credentials, etc. I think it can be a bit user hostile to have really stringent password requirements. I'd be all for some sort of strength indicator to hint to the user that the password they're selecting isn't that strong though.

What do you think?

Rick Harding @mitechie http://blog.mitechie.com http://lococast.net

[bigblind]

I agree that it can be a bit stringent to require very strong passwords, but I'd still want to make sure that users can't shoot themselves in the foot.

I'm currently looking into how to allow Bookie to monitor social media for links. Since we'll need to integrate authentication for social networks for this to work anyway, I'd suggest we also allow peopl people to log into Bookie using these networks.

2014-03-16 17:22 GMT+01:00 Rick Harding notifications@github.com:

On Sun, 16 Mar 2014, Frederik Creemers wrote:

The acceptable_password method currently accepts passwords that are longer than 3 characters with no further restrictions.

https://github.com/bookieio/Bookie/blob/develop/bookie/models/auth.py#L210

I'm currently working on a patch that will allow the minimum password length, and the types of characters that are required to be set in the settings. The problem is that I don't know enough about pyramid to know how to give the user a relevant error message.

So, can someone tell me where to start with flash message type things like this?

So the current password check takes place in a method called "acceptable_password" and the check is done:

https://github.com/bookieio/Bookie/blob/develop/bookie/views/auth.py#L204

I'd think we'd just update that method and update the message back.

I'd like to not get too carried away with complexity in the passwords. This is a list of people's bookmarks. We don't store private bookmarks yet, and I admit that will change, but even then it's not like we're storing anyone's bank credentials, etc. I think it can be a bit user hostile to have really stringent password requirements. I'd be all for some sort of strength indicator to hint to the user that the password they're selecting isn't that strong though.

What do you think?

Rick Harding @mitechie http://blog.mitechie.com http://lococast.net

Reply to this email directly or view it on GitHubhttps://github.com/bookieio/Bookie/issues/366#issuecomment-37761545 .

[mitechie]

I completely agree we'll need to look at better credentials when we start to support private and external 3rd party sites supplying bookmark content.

[bigblind]

Given that my GSoC proposal already includes social login, I'd suggest making these the primary login options. The most secure authentication options are the ones that are harder for us to screw up.

2014-04-06 17:31 GMT+02:00 Rick Harding notifications@github.com:

I completely agree we'll need to look at better credentials when we start to support private and external 3rd party sites supplying bookmark content.

Reply to this email directly or view it on GitHubhttps://github.com/bookieio/Bookie/issues/366#issuecomment-39671308 .