Address #1690 Min password entropy

This commit is contained in:
Zahary Karadjov 2020-10-06 21:55:04 +03:00 committed by zah
parent 9899578e1c
commit d98be078c3
4 changed files with 15 additions and 2 deletions

5
.gitmodules vendored
View File

@ -193,3 +193,8 @@
url = https://github.com/nitely/nim-normalize.git url = https://github.com/nitely/nim-normalize.git
ignore = dirty ignore = dirty
branch = master branch = master
[submodule "vendor/nim-zxcvbn"]
path = vendor/nim-zxcvbn
url = https://github.com/status-im/nim-zxcvbn.git
ignore = dirty
branch = master

View File

@ -36,7 +36,8 @@ requires "nim >= 0.19.0",
"prompt", "prompt",
"unicodedb", "unicodedb",
"web3", "web3",
"yaml" "yaml",
"zxcvbn"
### Helper functions ### Helper functions
proc buildAndRunBinary(name: string, srcDir = "./", params = "", cmdParams = "", lang = "c") = proc buildAndRunBinary(name: string, srcDir = "./", params = "", cmdParams = "", lang = "c") =

View File

@ -1,6 +1,6 @@
import import
std/[os, strutils, terminal, wordwrap, unicode], std/[os, strutils, terminal, wordwrap, unicode],
chronicles, chronos, web3, stint, json_serialization, chronicles, chronos, web3, stint, json_serialization, zxcvbn,
serialization, blscurve, eth/common/eth_types, eth/keys, confutils, bearssl, serialization, blscurve, eth/common/eth_types, eth/keys, confutils, bearssl,
spec/[datatypes, digest, crypto, keystore], spec/[datatypes, digest, crypto, keystore],
stew/[byteutils, io2], libp2p/crypto/crypto as lcrypto, stew/[byteutils, io2], libp2p/crypto/crypto as lcrypto,
@ -31,6 +31,7 @@ type
const const
minPasswordLen = 12 minPasswordLen = 12
minPasswordEntropy = 60.0
mostCommonPasswords = wordListArray( mostCommonPasswords = wordListArray(
currentSourcePath.parentDir / currentSourcePath.parentDir /
@ -165,6 +166,11 @@ proc keyboardCreatePassword(prompt: string, confirm: string): KsResult[string] =
" characters." " characters."
echo "" echo ""
continue continue
elif passwordEntropy(password) < minPasswordEntropy:
echoP "The entered password has low entropy and may be easy to " &
"brute-force with automated tools. Please increase the " &
"variety of the user characters."
continue
elif password in mostCommonPasswords: elif password in mostCommonPasswords:
echoP "The entered password is too commonly used and it would be " & echoP "The entered password is too commonly used and it would be " &
"easy to brute-force with automated tools." "easy to brute-force with automated tools."

1
vendor/nim-zxcvbn vendored Submodule

@ -0,0 +1 @@
Subproject commit ea6de3427d532a77eb83b63f431d5ddb850d5a17