search

hack4impact / flask-base

A simple Flask boilerplate app with SQLAlchemy, Redis, User Authentication, and more.
http://hack4impact.github.io/flask-base
MIT License
3.03k stars 479 forks source link

Add password requirements #12

Closed sandlerben closed 8 years ago

sandlerben commented 8 years ago

@aharelick said "Agree with max and the suggestions from owasp say we should make the minimum 8 characters. They also say that the recommendations may be out of date, but I think it's a good place to start. Also, we should probably add the validator to RegistrationForm and ResetPasswordForm and ChangePasswordForm."

maxmcc commented 8 years ago

While we're thinking about this, it might be best to use a password entropy estimator rather than a minimum required length—this one developed by Dropbox might be good to try out.

abhisuri97 commented 8 years ago

37 fix implementing the zxcvbn password check entropy estimator (javascript not python so users can have a live response for password strength)