search

michaelbanfield / devise-pwned_password

Devise extension that checks user passwords against the PwnedPasswords dataset
https://rubygems.org/gems/devise-pwned_password
MIT License
156 stars 29 forks source link

Optionally set a different password match threshold to warn users #16

Closed damonmorgan closed 5 years ago

damonmorgan commented 5 years ago

You may want to treat pwned passwords differently for new users vs existing users.

For example you may only want to reject passwords on sign up that are common (min_password_matches = 1000) but then still warn users if their password occurs at all in the list giving them the option to choose a better password.

If you do choose to have a different warning threshold, that threshold should then be used when a users changes their password so that they don't continue to be warned if they choose another password that is in the pwned list (but occurs with a frequency below the sign up threshold).

eae commented 5 years ago

Ohai @michaelbanfield the gem hasn't been updated with this change, is that intentional?

damonmorgan commented 5 years ago

Yes, it would be good to see this released as I’m still using my branch. I did it so it would be fully backwards compatible so it should be safe to release.