#3648 - Score passwords that contain the username lower

By Chris Graham
Added 30th Jul 2018, 6:47 AM
2 views

Identifier	#3648
Issue type	Feature request or suggestion
Title	Score passwords that contain the username lower
Status	Completed
Tags	Good for training (custom) Type: Security (custom)
Handling member	Chris Graham
Addon	core_cns
Description	If a password contains the username, discount all those letters from the scoring algorithm. Therefore the password may not hit the score threshold configured.
Steps to reproduce
Funded?	No

The system will post a comment when this issue is modified (e.g., status changes). To be notified of this, click "Enable comment notifications".

Rating

Unrated

Comments

By Guest posted 30th Jul 2018, 6:48 AM

Also consider doing the same for the DOB year, and the start of the email address.

By Guest posted 1st Nov 2019, 9:58 PM

Here are some nice guidelines on assessing password strength, which we could largely adopt (NIST):
https://specopssoft.com/blog/nist-password-compliance/

By Guest posted 15th Nov 2019, 5:04 PM

This should be unit tested.