Problem/Motivation

At the moment, this module doesn't store the plain text passwords, which leads to unnecessary complexity in the code to work around this. Additional features often lead to heated, never ending discussions such as #2420047: Force password reset after a minimum required password strength change.

In the case of #2446753: Password strength requirements are not enforced at the user API level, if the plain text password was available in the database, user accounts that have their password too strong could be blocked, only allowing those accounts with weak enough passwords to log in.

More generally, plain text passwords have well-known benefits such as making password recovery easier (for example for email users their password). It also makes your site more accessible for those who manage to download your database.

Proposed resolution

Store plain text passwords instead of the scores in the password_strength_score table. The score can be computed on the fly, which is useful for example if the zxcvbn algorithm changes.

Finally, this approach has the advantage that #2348437: Warn about common patterns/topologies which are easy to crack can be done on all the existing passwords of all the existing users as a post-processing step.

Remaining tasks

Get community agreement.

Comments

rupl’s picture

Priority: Major » Critical

+1 this is a brilliant way to keep from ever losing my password. bumping to critical because it's blocking the launch of my new government healthcare website.

Pol’s picture

Brilliant, amazing idea ! I like it too.

When we could also send by email the password when the user forget it !

budda’s picture

Could we consider doing a daily export to a text file in the files/ folder of the site for easier auditing purposes too?

Pol’s picture

Hello Budda,

I think it would be too dangerous, imagine if the server is compromised !

scor’s picture

Project: Password Strength » Bad judgement
Version: 7.x-1.x-dev » 9.x-3.0

Thanks for the ideas everyone!

After thinking about this overnight, and due to the lack of interest from the other maintainers, I think this feature would be a better fit for Bad Judgement.

scor’s picture

Category: Feature request » Bug report

Maybe that should even be a bug report...