[FEATURE] Password Strength UI about security-dashboards-plugin HOT 6 OPEN

I'm not sure if we have precedence for this kind of scenario, but approach 1 seems like a good candidate.

If you need another alternative, consider adding a parameter to the password setting API such as a 'dry-run' flag. Then you can reuse whatever error comes from the backend system to populate the front end ❌, or a ✔️

from security-dashboards-plugin.

Two possible ways we can solve this, as @cwperks pointed out, rule/regex based regex seems to be at odds, or at least not 1:1 with library based password scoring.

Approach 1 (my vote):
Step 1: - Don't allow users to create users with passwords that violate the regex rule specified in the config file
Step 2: - Try to use https://github.com/dropbox/zxcvbn - or similar to match UI with what backend would return for the strength of a given password

We will still allow users to try and send passwords that pass UI/frontend checks, but the backend will make the final call on whether that user's password strength is strong enough to allow for creation

Approach 2:
Step 1: Allow users to set whether they want to use regex based Password creation, or strength based password creation
Step 2: Modify Backend to only use the library if user selected strength based password creation, otherwise just check with the validation regex from the config
Step 3: Match the UI with whatever the user config is

from security-dashboards-plugin.

[Triage] @derek-ho thank you for filing this issue. Going to tag UX/UI, and assign this issue to you ;)

from security-dashboards-plugin.

In general, strong/weak indicators alone is rather ambiguous. We should provide upfront guidance on how to make passwords strong, eliminating any guesses on our users.

As users are typing in their passwords, I would consider specifically listing out which password criteria users are missing, so that users have clear actionable path.

from security-dashboards-plugin.

@derek-ho

Two possible ways we can solve this, as @cwperks pointed out, rule/regex based regex seems to be at odds, or at least not 1:1 with library based password scoring.

Is there an issue that gives full context behind why we need a password strength UI? What did @cwperks pointed out? Thanks.

from security-dashboards-plugin.