XF 2.1 Is there any sanctioned way to switch from "password_box-compiled.js" to "password_box.min.js??"

[Steve Gibson]

Hi All!

Our XenForo 2.1 installation is downloading a massive 824,235 byte password-checking JS file which mostly contains a massive list of disqualifying passwords. While I well understand the intent and value of this, I would much prefer to use the 2,524 byte password_box.min.js file. Is there any sanctioned way of switching to this very much smaller and simpler password-complexity script?

Thanks!

 

[Mike]

You can search the templates for "password_box-compiled.js" and change them to point to a different file, though that is violating an assumption of a dependency being included, so this may trigger JS errors. You'd have to disable password strength checking entirely.

 

[Steve Gibson]

Thanks, Mike. Your support is much appreciated.

 

[Steve Gibson]

To Mike, Kier and everyone...

XenForo's prolific AddOn developer AndyB saw my question yesterday and looked into what was going on. We learned that XF v2.1 has added a huge download of 30,000+ common words for use in cross-checking user-submitted passwords. Unfortunately, the way this is currently implemented, it's not only the registration or password-change dialogs that must wait for this file, but every logon. That's clearly wrong. And, moreover, this new massive 830K file should be implemented to download in the background so that the registration or password change pages are not held up waiting for this file to arrive and so that only if the file is not ready-to-run when the user submits their password should they need to wait for that JS function to be available.

Given how stunningly well-engineered and implemented this entire XenForo system is, I chalk this up to a first-release effect which I would expect XF's developers to get around to dealing with eventually. But we were getting complaints of 20-second delays in the display of the logon page after our upgrade from v2.0.12 to v.2.1. So, until, and unless, we get an official fix for this from XenForo, AndyB's new "Remove password check 1.0" addon restores XF's previous speedy logon page operation.