Advanced password complexity check

[igorw]

This post inspired me to create this topic. It's just an idea I had.

phpBB 3.0 has following options for password complexity:

• No requirements
• Must be mixed case
• Must contain letters and numbers
• Must contain symbols

Everybody knows the weakest link is often the user, so making him choose a secure password is a must. The provided options are not bad, but they can be improved. Here's some things I would like to see.

Blacklisting

I'm sorry, but following passwords shouldn't be allowed. 'password', '123456' (and variations of it). In fact, any of these. These passwords should be banned.

Password complexity plugins

It would be nice to have a pluggable password complexity architecture. This allows easy addition of new options, also through MODs.

Side note: Of course these plugins must not use any web services to validate the passwords ( ), perhaps a form of signing could be employed that warns the admin if he tries to use a non-validated plugin.

Composability

Building on the plugin idea, it should be possible to combine the plugins. An "AND" check on all of the currently active ones should be good enough.

Additional options

• Mustn't be username
• Mustn't be (dictionary word)(number)
• You name it!

Generate password

It would be nice to be able to generate a random password using javascript. Not sure if this is feasible in terms of entropy and RNG implementation, though.

[Nelsaidi]

How about a "Password Score" - Give the password a score from 1 - 100 or whatever using an algorithm, and let the admin set a minimum, this would take into consideration all the above - and even then they can be forced. Can probably have a JS to calculate client side to show the user too. Just an idea though.

The plugin system itself sounds like a good idea, and the above idea can be implemented using this idea In all seriousness it does open a wide range of password validation options. Although most would be regex or dictionary provided, the plugins would allow for additional processing - maybe breaking up the password to give inteligence - But it would be dodgy. Having mods deal with plain text passwords is something which could be a security risk, I dont know much about signatures but couldnt they be forged in the PHP world? Provided plugins go on phpbb.com then they should be safe, its just the easiness of plugins in terms of upload and enable in ACP means the user may not be aware of what they are installing, and provides an extremely easy method to steal passwords - this risk would come from mods not on phpbb.com though.

The benefit for this is great, and plugins expands the password checks from a mere db or regex search, and I'm sure most admins as I would appreciate it.