gWorldz / get-simple-cms

Automatically exported from code.google.com/p/get-simple-cms
GNU General Public License v3.0
0 stars 0 forks source link

Password security enforcement #295

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago
GetSimple seriously needs password security enforcement.

Passwords should be checked to be at least 8 characters long, and to contain 
small letters, large letters and numbers. All special characters should be 
disabled.

This will disable users in multi-user environment to create simple, easily 
breakable passwords.

Original issue reported on code.google.com by borislav...@gmail.com on 6 Feb 2012 at 12:29

GoogleCodeExporter commented 9 years ago
I may consider this... but not for 3.1 as we are past the "adding features" 
stage. 

Original comment by ccagle8 on 6 Feb 2012 at 1:38

GoogleCodeExporter commented 9 years ago
I understand, but I regard this as crucial.

One of stuff I do is integration and upkeep of computer networks. From my 
experience, users are _very_ keen to create simple passwords (anyone mentioned 
just name? or FL - First name Last name), as they do not understand security 
issues.

I have never had a user who would willingly have created MgPswrd11!#!.

Original comment by borislav...@gmail.com on 6 Feb 2012 at 2:26

GoogleCodeExporter commented 9 years ago
Why disable special characters? Prohibiting the use of special characters would 
make it more difficult to create a really secure password for those who want to.

Original comment by fil...@gmail.com on 11 Feb 2012 at 6:34

GoogleCodeExporter commented 9 years ago
Special characters are valid passwords
Multi users is not a core feature.

This should not be addressed at this time.

Original comment by tablatronics on 9 Mar 2012 at 1:32

GoogleCodeExporter commented 9 years ago
I wonder if spaces are available. Creating passwords which would be a complete 
sentence (lets say 3 words with starting with uppercase and ending with a dot), 
would make them almost unbreakable.
Haven't tested this in GS, but 99% of CMS I ever touched never allowed spaces 
in passwords.

Original comment by jo...@tlen.pl on 27 Apr 2012 at 7:47