Password Complexity

[charlesnw]

I would like Cloudron to support password complexity setting.

Allowing for (ideally via GUI and some kind of json/yaml etc file that can be version controlled/deployed via IAC):

(checkboxes/fields for setting:)

• Length
• Alphanumeric characters
• Special characters
• Mixed case
• Expiration

The default should be the same as it is now (to not break any existing users).

[p44]

@charlesnw Totally +1 for this feature.

[charlesnw]

Any update on this ? Where is the roadmap being set ? How can i help hack on this and send a PR?

[nebulon]

We used to have that actually, but given that apps which use LDAP were affected by this, we lifted those. By now the situation has changed quite a bit with most apps now being on OpenID, we have to revisit this.

Regarding the roadmap, we are looking into things for v9.1 and will open a thread here to discuss those items soon.
We do take this forum section into account, which is why it exists, so if feature requests have some traction by the community, they are more likely to be picked. So bumping threads and revisiting discussions here is a crude but useful way to signal for us.

[TLeM4]

Good idea, but password complexity is not measured with characters list or types but with entropy.
You can have good password with 7 characters and bad password with 10 characters.
An example to understand. I used KeePassXC password generator to measure these passwords entropy:

This is 7 characters password:

⊌ӊ⇊ٳ➟⋋О

Entropy: 116 bits.
Only "special characters". No length, No Alphanumeric, no mixed case.

This is 15 characters password:

8&w^3fck%NdMh4W

Entropy: 94 bits
Length, Alphanumeric, Special characters, Mixed case.

The first one only respect one requirement asked but is better than the second that respect all. The difference is huge if try with only 12 characters:

gx@V5iZLfuN7

Entropy: 65 bits. All requirements mets as the previous one, and it's not the worst i can have with 12 characters.

As it's common mistakes about password complexity, i think Cloudron should never allow to require characters list/types.
Instead, password complexity requirements should be technically measured with true entropy/bits algorithm as in KeePassXC that way good password will be allowed based on real complexity not on arbitrary rules.
The settings can always be displayed simple in settings with "Weak", "Average", "Good", "Excellent", etc... instead of entropy bits.

Finally, asking password to have specific characters list or type will break auto-generated password by password manager because websites has not all the same rules and password generators not the same default settings.

I hope this will help.