collecting_society

currently

validator = colander.Length(min=8)

is in effect for passwords. You want me to raise this to 10?

What kind of blacklist do you have in mind?

To cite Meik from #271: "generally, i think that relying on passwords as the only means to protect access to online accounts is a thing of the past. we should keep U2F in mind to be added in the mid term (but not right now).

that said, demanding a minimal length (i'd vote for 10 instead of 8) in combination with a check similar to e.g. "john the ripper" should do it for the moment. guess that could be implemented using a blacklist, if that particular blacklist is defined reasonably and updated on a regular basis."

Hypothesis:

If we use a blacklist and and keep it open source, we ironically lower overall entropy: A brute force attacker could simply wipe those passwords from his own dictionary and have better chance with this reduced set of often used passwords. So we have to keep the dictionary a secret, doing security by obfuscation.

Using bloom filter on Troy Hunts blacklist would reduce the needed storage from 10 to 1 GB:

https://gist.github.com/marcan/23e1ec416bf884dcd7f0e635ce5f2724

i think of two risk factors here:

1. an attack (brute force) on the login page directly
2. an attack on a password library that the attacker somehow got out of our servers

the first can be made next to impossible by running fail2ban (or a similar tool) on the webserver. it slows down any brute force attack significantly, so even if an attacker knows the dictionary of passwords he should have no reasonable chance to succeed. for this method to enhance security, passwords must be long enough to not counter measure the temporary IP banning.

for the second i assume that we're already salting and hashing passwords, which should again be a sufficient protection as long as the actual passwords are reasonable long and not easy to guess.

most of this will be rendered osolete with webauthn: https://webauthn.org