marius-wieschollek / passwords

A simple, yet feature rich password manager for Nextcloud
GNU Affero General Public License v3.0
211 stars 44 forks source link

[BUG]: Too many requests to pwned #667

Closed X-Raph-X closed 2 months ago

X-Raph-X commented 2 months ago

⚠️ This issue respects the following points: ⚠️

Server Information

www-data@nextcloud:~/nextcloud$ php ./occ passwords:system:report debug
{
    "version": {
        "server": "28.0.3.2",
        "app": "2024.7.20",
        "lsr": false,
        "php": "8.2.22",
        "cronPhp": "8.2.22"
    },
    "environment": {
        "os": "Linux",
        "architecture": "x86_64",
        "bits": 64,
        "database": "mysql",
        "cron": "cron",
        "proxy": false,
        "sslProxy": true,
        "subdirectory": false
    },
    "services": {
        "images": "imagick",
        "favicons": "bi",
        "previews": "screeenly",
        "security": "hibp",
        "words": "auto",
        "previewApi": true,
        "faviconApi": false
    },
    "status": {
        "autoBackupRestored": false
    },
    "settings": {
        "channel": "stable",
        "nightlies": false,
        "handbook": false,
        "performance": 5
    },
    "encryption": {
        "sse": {
            "SSEv1r1": false,
            "SSEv1r2": true,
            "SSEv2r1": false,
            "SSEv3r1": false,
            "none": true,
            "default": "none"
        },
        "cse": {
            "CSEv1r1": true,
            "none": true,
            "default": "CSEv1r1"
        }
    }
}

Client Information

Browser and Version: Firefox up to date 129.0.2 Client OS and Version: Windows 11 and Linux Debian SID

Bug description

Hi, I use your application since a while and I am very satisfyed, this piece of software keeps all my life into his hands. I use the service pwned to check the validity of my passwords and I can see that the service is asked very often by the server, something like 10 times per minutes. Is it normal? Is it too much?

Screenshot 2024-09-06 101853

Thank you for your great job!

Steps to reproduce

  1. install the app on Nextcloud
  2. choose pwned as service to check the password quality
  3. store some passwords
  4. check the DNS queries made by the Nexcloud server

Expected behavior

In my opinion, there is too much requests but I might be wrong. The purpose of this issue is to share this information and have a feedback. Perhaps it is normal and in this case I would like to know why? Otherwise it is something that can be corrected but there is no emergency.

Nextcloud Logs

No response

Browser Logs

No response

marius-wieschollek commented 2 months ago

This looks completely normal. The app checks the password hashes every day, so there should be some requests. The app also checks if HIBP can be reached, e.g. when you open the settings page.