Feature request - blacklist passwords

[asheenlevrai]

Thank you 🙂

On the webpage corresponding to this plugin I can read:
"Passwords can also be checked against a list of the 10,000 most commonly used ones.
Passwords can also be checked anonymously against the haveibeenpwned passwords API. "

I guess the plugin doesn't provide yet a way to prevent the re-use of "compromised" passwords, right? I mean passwords that users may have shared with others, for instance. Or passwords that are laying around, written on a post-it....

One way to do this, though, according to what I quoted above, would be to allow the admin to define a custom list of banned passwords. I don't know if the aforementioned list of the 10,000 most commonly used passwords is stored online or locally. If it's locally, maybe the admin could add passwords to this list in order to make sure they are not used. Otherwise (if it's online), maybe passpolicy could check passwords against a 3rd list: a local blacklist that the admin could manage.

Now, I imagine 2 scenarios:

1. the admin knows that UserX has his password compromised and the admin knows the password of UserX
   -> the admin can manually add the password to the blacklist
2. the admin knows that UserX has his password compromised but the admin doesn't know the password of UserX
   -> the admin should be able to tell the passpolicy plugin to blacklist the current password of UserX and force UserX to chose a new password.

What do you think?
Does this make any sense?
Is it something you might consider implementing?

Best,
-a-

[listerr]

1: So you want to prevent other users from setting the same password? I suppose it wouldn't be too difficult to add a second file like 10k-common-passwords.txt, but which is editable from the admin config.

2FA is possibly a more robust solution than trying to blacklist passwords, then it doesn't matter as much if two users have the same (possibly compromised) password, or do stupid things like write important passwords on post-its: The second factor is still required.

2: This extension is probably not the right place, as it only does things in the password change process and not the login process. You can use the plugin: forceuserchange - add the user to a group and it will force a password change when they next login and remove them from the group. (Or the logic can be reversed: if they are not in a group, change password and add them to the group.) I used this plugin when upgrading DW, as we had very old crypt() based password hashes in the passwd file and I wanted to get everyone to set their password again so it would change the password hash to bcrypt.