Re: How to require stronger passwords for Roundup (1.5.1)
"Hancock, David (DHANCOCK)" <[email protected]>
| Newsgroups | gmane.comp.bug-tracking.roundup.user |
|---|---|
| Message-ID | <[email protected]> |
Thank you the ideas on this thread. The idea of writing an auditor/reactor to check the passwords was the most appealing initially, but I ran into a problem. By the time userauditor gets to see the password from newvalues['password'] it's already been hashed:
{PBKDF2}10000$GeodPG9LmZAwMCRrv79u7oVTHyg$ZYZaios16Kiq4wYB4zHHV1Lo00Q
So my string-based checked for minimum length, letters, numbers, punctuation would pass for ANY password once it's hashed.
Is there something I'm missing here? The userauditor.py approach fits my (small) brain.
The other ideas were about connecting other authentication systems instead of using Roundup's, but we're trying to eliminate dependency on another system, and we've got everybody's information in Roundup already.
Cheers!
--
David Hancock | [email protected]
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot