Password Tools 2.3.5

[Freelancer]

Pwned password integration

Does that mean a User Password is send over the internet and compared to other Passwords on multiple servers? Isn't that increasing a risk of someone outside in control of those servers being able to "tap in" the data flow and retrieve passwords? How likely realistic is my assumption?

 

[Xon]

Does that mean a User Password is send over the internet and compared to other Passwords on multiple servers? Isn't that increasing a risk of someone outside in control of those servers being able to "tap in" the data flow and retrieve passwords? How likely realistic is my assumption?

This is why the update says:

• See Validating Leaked Passwords with k-Anonymity for details. Warning; contains Maths.

It creates a hash of the password, then submits a small piece (the first 5 characters) to the API service (via HTTPS). The API service then returns all known password hashes that start with that prefix.

Finally, this is a configurable so admins can turn the feature off.

 

[Freelancer]

Thanks for the clarification. Well-conceived as always.

 

[RobinHood]

It's built into 1Password now too

https://blog.agilebits.com/2018/02/22/finding-pwned-passwords-with-1password/

 

[WoodiE]

It's built into 1Password now too

https://blog.agilebits.com/2018/02/22/finding-pwned-passwords-with-1password/

Since you've mentioned it, not only has 1Password also integrated Pwned Passwords into their application, Mozilla Firefox will be soon, Wordpress security plug-in Wordfence does, bittylicious does, Laravel does, and there are already many other user created tools to do the same on Github and plenty other services I'm sure.

Huge thanks to @Xon for working with me on this project and adding this feature so that we can now say, Xenforo also has integration with Pwned Passwords!

Who knows maybe @Mike will consider adding a similar feature into the base of Xenforo as this is one of those features that not only keep forum owners a bit more secure but also their users more secure by discouraging them from re-using passwords that are already well known from confirmed breaches per Have I Been Pwned.

Thanks again @Xon for your work and knocking this out so quickly. The Pwned Passwords feature works perfectly and the addition of zxcvb is only icing on the cake.

 

[Alpha1]

Are existing members alerted it their password is too weak or is in the hibp DB?

What does it mean when the top field has a red X and the bottom password field has a green checkmark? The password is 'very strong'.

 

[iamjudd]

Any plans for a xf2 version?

 

[Xon]

Are existing members alerted it their password is too weak or is in the hibp DB?

Nope, it only triggers on a password change/set.

What does it mean when the top field has a red X and the bottom password field has a green checkmark? The password is 'very strong'.

I need to add some on-hover text.

The bottom checkmark means it matches, while the top is if it is valid. If it says 'very strong' it should be ok. Can you send me some details via PM?

Any plans for a xf2 version?

Eventually.

 

[eva2000]

nice @Xon would this in anyway conflict with Dragonbyte Security's feature I wonder @DragonByte Tech ?

 

[DragonByte Tech]

nice @Xon would this in anyway conflict with Dragonbyte Security's feature I wonder @DragonByte Tech ?

View attachment 170592

Specifically for that page no. For the general HIBP lookup, I make a call to their servers querying whether the username or email has been found in their DB, I do not do any form of partial password hash transfer like 1Password or this would do.


Fillip

 

[eva2000]

cheers @DragonByte Tech thanks for clarification

 

[SeToY]

Xon updated Password Tools with a new update entry:

1.3.4 - Feature Update. Pwned password integration

Hi,

so the add-on went from v2.2.1 to v1.3.4?

 

[Xon]

Hi,

so the add-on went from v2.2.1 to v1.3.4?

Typo'ed the version id, fixed

 

[Xon]

Xon updated Password Tools with a new update entry:

2.3.5 - Bugfix update

• Fix red 'X' next to password may not be removed on a valid password.
• Prevent displaying the password comparison checkbox if the feature is disabled

Read the rest of this update entry...

 

[Dragonsys]

Notes

• I plan to port this to XF2.

looking forward to this one

 

[Flagy_]

Hey @Xon, I have upgraded the add-on, but the 'X' still didn't change when I typed the password.

 

[Xon]

@Flagy_ can you try force-refreshing the page? Make sure you uploaded the update javascript files

 

[Flagy_]

Now is fixed, thank you very much.

 

[Yawn]

Is there any estimate or rough timeline on the XF2 port?

 

[Xon]

Is there any estimate or rough timeline on the XF2 port?

It is planned, just no ETA yet.

I maintain a rough list of planned add-ons to port to XF2; https://atelieraphelion.com/threads/add-ons-converted-to-xenforo-2.320/ If you want an add-on to jump to the head of the queue, start a conversation to discuss funding it.