Issue#9 Add password hardness evaluation - Githubissues

labbsr0x / whisper

A cloud-native Identity and OAuth Provider implemented with Golang and ORY Hydra

MIT License

12 stars 4 forks source link

Issue#9 Add password hardness evaluation #35

Closed claudiosegala closed 4 years ago

claudiosegala commented 4 years ago

This PR solves #9

The implementation follows what was discussed in the issue and an added security measure:

Passwords must have at least 12 characters (length);
Passwords must have at most 30 characters (length);
At least 7 different characters (entropy);
The password cannot be obvious, e.g. username or email (naiveness);

The added security measure (max length) is to avoid attacks that use giant strings to slow down the server.