Add passwdqc, optionally require passwords pass both zxcvbn and passwdqc

paragonie / airship

Secure Content Management for the Modern Web - "The sky is only the beginning"

https://cspr.ng

Other

418 stars 41 forks source link

Open paragonie-scott opened 8 years ago

paragonie-scott commented 8 years ago

While zxcvbn is a great password strength estimator, there are situations where passwdqc is better. The downside is that passwdqc is pass/fail.

Ideally, administrator passwords should require a zxcvbn score of 4 or higher and should also pass passwdqc's evalutation.

This is going to require a fresh port of passwdqc to PHP, since the existing ones aren't very good.

kelunik commented 8 years ago

More labels please! config, ui, ux, tools should be removed I think.

paragonie-scott commented 8 years ago

If you could read my mind, you'd understand why those labels were chosen. ;)

But I'm not sure how I'm going to implement this yet, really.

kelunik commented 8 years ago

If you could read my mind, you'd understand why those labels were chosen. ;)

I'm afraid I can't. :-(

paragonie-scott commented 7 years ago