Set password complexity

[Shamil]

I think admins should be able to set password complexity requirements for new registrations, and, can force users to change password, or define password expiry.

 

[Shamil]

As said, in some situations this is very desirable.

My father is newer to the internet than I, but uses many web applications in which there is a password complexity requirement. I have to say, his password choices are much more secure than mine at the moment.

Having a system where the software pre-populates or suggests passwords might be OTT, but also, I never remember those. Sticking 123, although undesirable, is still better than having no numbers there at all. In this instance, the browser mechanism would allow for the password to be saved anyway.

 

[Parsnip]

Did anything ever come of this? I can't find any add-ons that help. At the least I would like to be able to specify a minimum password length for users to comply with.

 

[Kevin]

A bump for interest. I'd like to see some type of minimal password complexity check as well in XF. Even if it doesn't enforce a PW complexity it would be nice to at least give an alert to the user when they are setting their password as to whether it is a considered a weak PW or not.

 

[Biker]

A bump for interest. I'd like to see some type of minimal password complexity check as well in XF. Even if it doesn't enforce a PW complexity it would be nice to at least give an alert to the user when they are setting their password as to whether it is a considered a weak PW or not.

Now THIS I could get behind. I do like the little popups that tell me I'm insane when setting passwords.

 

[Alpha1]

Please add settings in XenForo for minimum password requirements.
i.e.
Minimum characters:
Minimum numbers:
Minimum higher case:
Minimum special signs:
Minimum strength:

And ofcourse show what the user still needs to do to meet the requirements.

 

[Liam W]

For those that need this now:

https://xf-liam.com/products/password-requirements.21/

 

[Biker]

It should be noted that complex passwords are never the answer. Pass phrases are much more difficult to guess and are much easier to remember by users.

Sites that require a convoluted mix of alphanumeric characters rarely get a repeat visit from me. The thinking that these types of passwords are "all that" is totally out of whack when dealing with users and making things easy AND secure for them.

https://xkcd.com/936/

 

[AlazarMC]

Strongly support this.

 

[RobinHood]

Good article here from Jeff Atwood, one of the Discourse coders on some research he's carried out while improving their login amd registration system

https://blog.codinghorror.com/password-rules-are-********/

Better password generation guidance would be nice. Currently using an add on to increase the length requirement

 

[RobinHood]

The starred part is bullsh...