658370 - update password blacklist for sumo

Status: RESOLVED WONTFIX

(support.mozilla.org :: Users and Groups, task)

Description

[Chris Lyon [:clyon]]

Attachment: blacklist of passwords

Here is the list of passwords.

Comment 1

[James Socol [:jsocol, :james]]

We can put the file on NFS and point PASSWORD_BLACKLIST to it in settings_local.py.

Comment 2

[Jeremy Orem [:oremj]]

If we are going to use this can we check it in and deploy it with the app?

Comment 3

[James Socol [:jsocol, :james]]

(In reply to Jeremy Orem [:oremj] from comment #2)
> If we are going to use this can we check it in and deploy it with the app?

No, because it contains commonly used passwords on our systems.

Comment 4

[James Socol [:jsocol, :james]]

:curtisk - Is this password blacklist still the right one? If not, how do we go about getting an updated list?

Comment 5

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

:jsocol - this appears to be something that clyon came up with as I've checked around and no one seems to know where this came from or if there is a new list.

Comment 6

[James Socol [:jsocol, :james]]

:curtisk - so, should we install this list, find a new list, or revisit this idea entirely?

Comment 7

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

I have no idea what the original intent here was, I can infer that the goal was to get some kind of password complexity. And if that is the goal then I suspect it would make more sense to use a repeatable method that allows us to gauge password complexity and allow or disallow a given password based on that pattern. The downside of a list for this type of usage is that the list may not be complete or still allow for passwords that would be considered weak. I would recommend revisit the idea entirely as the root goal here appears to have been lost over the last 2 years.

Comment 8

[James Socol [:jsocol, :james]]

Done and done.

Comment 9

[Will Kahn-Greene [:willkg] ET needinfo? me]

These bugs are all resolved, so I'm removing the security flag from them.