Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixing issue #1520 and fixing previous error #1572

Closed
wants to merge 5 commits into from
Closed

Fixing issue #1520 and fixing previous error #1572

Changes from 4 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
0915af9
resolving issue no. 1520
eth-developer03 Dec 25, 2024
778f94b
Update: Authentication_Cheat_Sheet.md #1520
eth-developer03 Dec 29, 2024
f959f5d
Re-Update: Authentication_Cheat_Sheet.md #1520
eth-developer03 Dec 29, 2024
a0a1c0e
updating authentication.md
eth-developer03 Dec 31, 2024
04135c8
updating authentication.md issue #1520
eth-developer03 Jan 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion cheatsheets/Authentication_Cheat_Sheet.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,8 @@ A key concern when using passwords for authentication is password strength. A "s
- **Maximum** password length should be **at least 64 characters** to allow passphrases ([NIST SP800-63B](https://pages.nist.gov/800-63-3/sp800-63b.html)). Note that certain implementations of hashing algorithms may cause [long password denial of service](https://www.acunetix.com/vulnerabilities/web/long-password-denial-of-service/).
- Do not silently truncate passwords. The [Password Storage Cheat Sheet](Password_Storage_Cheat_Sheet.md#maximum-password-lengths) provides further guidance on how to handle passwords that are longer than the maximum length.
- Allow usage of **all** characters including unicode and whitespace. There should be no password composition rules limiting the type of characters permitted. There should be no requirement for upper or lower case or numbers or special characters.
- Ensure credential rotation when a password leak occurs, or at the time of compromise identification.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think this should be removed - its still accurate that if a breach occurs then passwords should be rotated.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@szh - You don't think this sentence on the next line adequately addresses that?

Consider password rotation only in case of compromise or when authenticator technology is changed.

I guess it could be worded more strongly, such as:

Ensure credential changes take place if a compromise is detected ...

But I thought it more or less addressed the same concern.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I think "consider" isn't strong enough. If there's a breach, passwords MUST be rotated.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok I'll change it

- Avoid requiring periodic password changes; instead, encourage users to pick strong passwords and enable **Multi-Factor Authentication (MFA)**. Consider password rotation only in case of compromise or when authenticator technology is changed.
According to [NIST guidelines](https://pages.nist.gov/800-63-3/sp800-63b.html), verifiers should not mandate arbitrary password changes (e.g., periodically).
- Include a password strength meter to help users create a more complex password and block common and previously breached passwords
- [zxcvbn-ts library](https://github.com/zxcvbn-ts/zxcvbn) can be used for this purpose.
- [Pwned Passwords](https://haveibeenpwned.com/Passwords) is a service where passwords can be checked against previously breached passwords. You can host it yourself or use the [API](https://haveibeenpwned.com/API/v3#PwnedPasswords).
Expand Down