{"action":"created","issue":{"url":"https://api.github.com/repos/ParabolInc/action/issues/1800","repository_url":"https://api.github.com/repos/ParabolInc/action","labels_url":"https://api.github.com/repos/ParabolInc/action/issues/1800/labels{/name}","comments_url":"https://api.github.com/repos/ParabolInc/action/issues/1800/comments","events_url":"https://api.github.com/repos/ParabolInc/action/issues/1800/events","html_url":"https://github.com/ParabolInc/action/issues/1800","id":300355501,"number":1800,"title":"Strengthen Password Requirements","user":{"login":"dan-f","id":2146312,"avatar_url":"https://avatars3.githubusercontent.com/u/2146312?v=4","gravatar_id":"","url":"https://api.github.com/users/dan-f","html_url":"https://github.com/dan-f","followers_url":"https://api.github.com/users/dan-f/followers","following_url":"https://api.github.com/users/dan-f/following{/other_user}","gists_url":"https://api.github.com/users/dan-f/gists{/gist_id}","starred_url":"https://api.github.com/users/dan-f/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dan-f/subscriptions","organizations_url":"https://api.github.com/users/dan-f/orgs","repos_url":"https://api.github.com/users/dan-f/repos","events_url":"https://api.github.com/users/dan-f/events{/privacy}","received_events_url":"https://api.github.com/users/dan-f/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/ParabolInc/action/milestones/50","html_url":"https://github.com/ParabolInc/action/milestone/50","labels_url":"https://api.github.com/repos/ParabolInc/action/milestones/50/labels","id":3117903,"number":50,"title":"New Login","description":"For stories pertaining to the new login page, which will replace the old landing page.","creator":{"login":"dan-f","id":2146312,"avatar_url":"https://avatars3.githubusercontent.com/u/2146312?v=4","gravatar_id":"","url":"https://api.github.com/users/dan-f","html_url":"https://github.com/dan-f","followers_url":"https://api.github.com/users/dan-f/followers","following_url":"https://api.github.com/users/dan-f/following{/other_user}","gists_url":"https://api.github.com/users/dan-f/gists{/gist_id}","starred_url":"https://api.github.com/users/dan-f/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dan-f/subscriptions","organizations_url":"https://api.github.com/users/dan-f/orgs","repos_url":"https://api.github.com/users/dan-f/repos","events_url":"https://api.github.com/users/dan-f/events{/privacy}","received_events_url":"https://api.github.com/users/dan-f/received_events","type":"User","site_admin":false},"open_issues":5,"closed_issues":4,"state":"open","created_at":"2018-02-14T21:27:30Z","updated_at":"2018-02-27T02:06:11Z","due_on":null,"closed_at":null},"comments":2,"created_at":"2018-02-26T18:57:59Z","updated_at":"2018-02-27T17:52:52Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"## Issue - Enhancement\r\n\r\nWe don't have any password requirements. For our users' (and our) security, we should strengthen the requirements without putting an undue burden on our users.\r\n\r\n### Acceptance Criteria (optional)\r\nPasswords must:\r\n- Have a minimum length of 8 characters\r\n- Include at least one upper-case character\r\n- Include at least one lower-case character\r\n- Include at least one digit (`[0..9]`)\r\n\r\n- **Estimated effort:** 11 points ([see CONTRIBUTING.md](https://github.com/ParabolInc/action/blob/master/CONTRIBUTING.md#points-and-sizes))\r\n"},"comment":{"url":"https://api.github.com/repos/ParabolInc/action/issues/comments/368966745","html_url":"https://github.com/ParabolInc/action/issues/1800#issuecomment-368966745","issue_url":"https://api.github.com/repos/ParabolInc/action/issues/1800","id":368966745,"user":{"login":"mattkrick","id":5514175,"avatar_url":"https://avatars0.githubusercontent.com/u/5514175?v=4","gravatar_id":"","url":"https://api.github.com/users/mattkrick","html_url":"https://github.com/mattkrick","followers_url":"https://api.github.com/users/mattkrick/followers","following_url":"https://api.github.com/users/mattkrick/following{/other_user}","gists_url":"https://api.github.com/users/mattkrick/gists{/gist_id}","starred_url":"https://api.github.com/users/mattkrick/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mattkrick/subscriptions","organizations_url":"https://api.github.com/users/mattkrick/orgs","repos_url":"https://api.github.com/users/mattkrick/repos","events_url":"https://api.github.com/users/mattkrick/events{/privacy}","received_events_url":"https://api.github.com/users/mattkrick/received_events","type":"User","site_admin":false},"created_at":"2018-02-27T17:52:52Z","updated_at":"2018-02-27T17:52:52Z","author_association":"OWNER","body":"from a security standpoint, i won't say it's a bad idea to add those requirements, but it's essentially security theater on par with the TSA in airports. On that link, check out the further reading: \r\n> Your Password Complexity Requirements are Worthless - OWASP AppSecUSA 2014 presentation for further discussion of legacy password complexity rules\r\n\r\nhere's a link to the important section: https://youtu.be/zUM7i8fsf0g?t=22m52s\r\nUnfortunately, the guy completely contradicts himself by saying requirements are useless, and then goes on to say it should be a PCI-compliance requirement (although by complexity maybe he's talking about hashing?). So look at the attack vectors:\r\n- a keylogger (css exploit via extension, etc) on the victim doesn't care about complexity, it sees the password\r\n- a MITM doesn't care about complexity, after breaking your TLS, it's plaintext\r\n- a DB doesn't care about complexity, it salts + hashes your password. If someone pwns auth0, they've got a few millenia to send out \"change your password\" emails\r\n- a user DOES care about complexity. they want something easy to remember. Most likely, the use a password manager or oauth2, or already use decent password requirements.\r\n\r\nIf the only party affected by requirements is the user, and they're negatively affected by it, then we should appease them.\r\n"}}
{"actor":{"display_login":"mattkrick"}}