a.daniello Posted January 16, 2015 Report Share Posted January 16, 2015 Editing account/contact, there’s a great function “generate password”, but input type is “password” so if i click on link "generate password" i can generate a new "secure" password... ... so secure that i can’t see it!! Quote Link to comment Share on other sites More sharing options...
0 Paul Posted January 16, 2015 Report Share Posted January 16, 2015 Originally it was not a password field, which meant you could see the generated password. Admittedly, it is now less useful. We created CORE-552 to create a modal box where the password will be generated and displayed, then saved to the form as is now. Michael 1 Quote Link to comment Share on other sites More sharing options...
0 a.daniello Posted January 16, 2015 Author Report Share Posted January 16, 2015 Ah, ok! Thanks Quote Link to comment Share on other sites More sharing options...
0 Tyson Posted January 17, 2015 Report Share Posted January 17, 2015 I would really like to have that password generator sooner rather than later. Blesta Addons and Jonathan 2 Quote Link to comment Share on other sites More sharing options...
0 domaingood Posted January 17, 2015 Report Share Posted January 17, 2015 Also Add Password Score to must need score 50+ otherwise basic password not taken Like (Ex: 123456).because Here is customer domain and hosting. Thank you Jonathan and Blesta Addons 2 Quote Link to comment Share on other sites More sharing options...
0 Jonathan Posted January 19, 2015 Report Share Posted January 19, 2015 +1, especially on the strength meter/requirement setting Quote Link to comment Share on other sites More sharing options...
0 Tyson Posted January 19, 2015 Report Share Posted January 19, 2015 Also Add Password Score to must need score 50+ otherwise basic password not taken Like (Ex: 123456).because Here is customer domain and hosting. Thank you Attributing a "score" to passwords would be arbitrary, unless you have specific requirements that dictate how such a score could be constructed? Passwords may need to conform to different guidelines depending on where it is used and what it helps to protect. I wouldn't want someone to think that an arbritrary score of "100" somehow makes a password secure. Quote Link to comment Share on other sites More sharing options...
0 Jonathan Posted January 19, 2015 Report Share Posted January 19, 2015 Attributing a "score" to passwords would be arbitrary, unless you have specific requirements that dictate how such a score could be constructed? Passwords may need to conform to different guidelines depending on where it is used and what it helps to protect. I wouldn't want someone to think that an arbritrary score of "100" somehow makes a password secure. Scores for passwords in applications are generally derived by meeting certain criteria, most often times javascript is use to determine this "on the fly". For example: https://tech.dropbox.com/2012/04/zxcvbn-realistic-password-strength-estimation/ Sure it's somewhat arbitrary, but creating secure passwords really isn't hard so having an arbitrary meter to help guide people would be very useful. domaingood 1 Quote Link to comment Share on other sites More sharing options...
0 Tyson Posted January 19, 2015 Report Share Posted January 19, 2015 The problem with using an arbitrary password score in Blesta is that each password field would need to define its own requirements and its own algorithm for calculating scores since the passwords Blesta accepts range from Blesta account passwords to cPanel account passwords and more, and each system has different requirements. For example, if cPanel only allows up to 12 character passwords, and Blesta only allows 13+ characters to be scored at 100, it gives the false impression that there is more to be gained. Personally, I don't think a password score is necessary. I think it would be more beneficial to show whether the password conforms to its given password requirements, and then the requirements can be set to whatever you would determine a score of 100 to be. Quote Link to comment Share on other sites More sharing options...
0 Jonathan Posted January 19, 2015 Report Share Posted January 19, 2015 The problem with using an arbitrary password score in Blesta is that each password field would need to define its own requirements and its own algorithm for calculating scores since the passwords Blesta accepts range from Blesta account passwords to cPanel account passwords and more, and each system has different requirements. For example, if cPanel only allows up to 12 character passwords, and Blesta only allows 13+ characters to be scored at 100, it gives the false impression that there is more to be gained. Personally, I don't think a password score is necessary. I think it would be more beneficial to show whether the password conforms to its given password requirements, and then the requirements can be set to whatever you would determine a score of 100 to be. Fair enough. Technically speaking that makes good sense. A password requirement criteria would be just as good if not better. All I'm looking to do is force people's "password123" passwords into something a bit better. Whether it's by means of an arbitrary score or set of requirements I don't really care as long as it's user-friendly. Perhaps with this criteria ruleset instead of a score a javascript list of requirements that'd "tick" when the requirement was met would be nice. Quote Link to comment Share on other sites More sharing options...
0 Paul Posted January 19, 2015 Report Share Posted January 19, 2015 Password scores can be useful to end-users by simply making them think about their password selection. If they want to choose something we arbitrarily deem as "poor" security-wise, then at least they are making a conscience decision about it. It may nudge people into creating a better password, and save us the headache of a breached account. In terms of arbitrary, the link Jonathan posted -- https://tech.dropbox.com/2012/04/zxcvbn-realistic-password-strength-estimation/ probably best fits with our understanding of secure passwords. Length is better than special characters, and passwords that are difficult for computers to guess but easy for people to remember. Worth considering. Blesta Addons, Jonathan and domaingood 3 Quote Link to comment Share on other sites More sharing options...
0 a.daniello Posted January 19, 2015 Author Report Share Posted January 19, 2015 A simple "visual note" about a selected password, is good and not invasive: user can choose arbitrarily if accept or not. https://www.dropbox.com/register (based on https://tech.dropbox.com/2012/04/zxcvbn-realistic-password-strength-estimation/) is a great sample. Jonathan and domaingood 2 Quote Link to comment Share on other sites More sharing options...
0 Paul Posted January 23, 2015 Report Share Posted January 23, 2015 I've added CORE-1562 for a password strength indicator. It relates to CORE-552 which describes auto generating passwords. Michael 1 Quote Link to comment Share on other sites More sharing options...
0 a.daniello Posted January 23, 2015 Author Report Share Posted January 23, 2015 Thanks! Quote Link to comment Share on other sites More sharing options...
Question
a.daniello
Editing account/contact, there’s a great function “generate password”, but input type is “password” so if i click on link "generate password" i can generate a new "secure" password...
... so secure that i can’t see it!!
Link to comment
Share on other sites
13 answers to this question
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.