Request for more password generator options

[jbrayton]

My web service requires that each password have at least one uppercase letter, at least one lowercase letter, and at least one digit. The ability to specify these requirements in the passwordGenerationOptions argument to storeLoginForURLString:... would be very helpful.

Thank you.

[radazzouz]

Hi @jbrayton,

Thank for for requesting this feature. We are planing on exposing more options for the Password Generator in the future. These options include mixed cases (uppercase and lowercase), digits and other character separators.

Regards,

[pirocso]

Same here - my upcoming app requires at least one uppercase letter, one lowercase letter, one digit and one special character - 6 characters minimum

[radazzouz]

Hi @pirocso,

Thanks for sharing your requirements with us. This will help us to better plan and implement this enhancement.

Cheers!

[bryanjclark]

Hey, I'm on the Starbucks iOS team, and we'd love to have this feature, too! Ideally, some method of passing in either a black-list or white-list set of characters, and the password generator can do its magic.

[radazzouz]

Hi @bryanjclark,

Thanks so much for letting us know about your use-case. 👍

I like the white-list idea so far and I will discuss it with my colleagues to make sure that it'll end up being "white" magic 😉

So please keep an eye on this issue for updates.

Cheers!

[bryanjclark]

@radazzouz thanks very much! Looking forward to it - let me know if there's any way to help out!

[radazzouz]

Hi guys,

Could you please list your password requirements? Such as:

• Characters that are not accepted or that are required.
• Password min/max length.
• Lowercase vs uppercase. Especially if your password must start with either lowercase or uppercase.
• Any other pertinent information which would enable us to properly implement this feature.

Thanks!

[bryanjclark]

Absolutely! We're putting together a little list; I'll get back to you soon. Thanks so much!

[radazzouz]

Thank you, Bryan! 😄

[bryanjclark]

Alright! Did some digging around, and here's what I think a dev might look for in a password generator: the ability to specify the number of required capital, numeral, and special characters.

In this example, let's say we have a set of known-to-be-safe special characters, as well as minimum requirements for lowercase, uppercase, numerals, and special characters.

The set of known-to-be-safe characters is:
~ ; . _ / ' " ? & : \ ’

These password requirements might be expressed as:

NSDictionary *passwordGenerationOptions = @{
        AppExtensionGeneratedPasswordMinLengthKey: @(6),
        AppExtensionGeneratedPasswordMaxLengthKey: @(30),
        AppExtensionGeneratedPasswordAllowedSpecialCharactersKey = @"~;._/'\"?&:\\’",
        AppExtensionGeneratedPasswordMinUppercaseKey: @(1),
        AppExtensionGeneratedPasswordMinLowercaseKey: @(1),
        AppExtensionGeneratedPasswordMinNumeralsKey: @(1),
        AppExtensionGeneratedPasswordMinSpecialCharactersKey: @(1)
    };

As a dev, it feels "safer" to whitelist characters instead of blacklist characters - because then I can say "I definitely know that these 12 characters are safe; I've tested them so they can go on a whitelist"

(Versus "I know that these 8 aren't allowed, so they are on the blacklist, but since I probably haven't tested every character, I can't say for sure.")

One API choice that I'm not sure about: instead of providing a string of characters, perhaps an array of characters would be better? As in, one of these options:

1. as a string: @"~;._/'\"?&:\\’"
2. as an array: @[@"~", @";", @".", @"_", @"/", @"'", @"\"", @"?", @"&", @":", @"\\", @"’"]
3. maybe there's a third way?

(Note: the \ and "characters in the SpecialCharacters will need to be escaped with a \ prefix, as I've done above.

[radazzouz]

Thanks @bryanjclark for taking the time to put it all down! This gives us plenty of information to work with 👍

One more question:

In your case (hypothetical or not), you need the generated password to contain at least one uppercase letter, one lowercase letter, one digit and one special character. Am I right to assume that your backend would not accept it (the generated password) if it does not respect all of the constraints above? Let’s say that the generated password does not have a digit at all.

Cheers!

[bryanjclark]

In your case (hypothetical or not), you need the generated password to contain at least one uppercase letter, one lowercase letter, one digit and one special character. Am I right to assume that your backend would not accept it (the generated password) if it does not respect all of the constraints above? Let’s say that the generated password does not have a digit at all.

Correct, yep! So in the above example, the resulting password would need to have:

• Between 6 and 30 characters
• At least 1 uppercase letter
• At least 1 lowercase letter
• At least 1 number
• At least one special character, from the whitelisted set of special characters

If 1Password returned a string of text that didn't meet those requirements (as you described) we would likely catch it client-side (since we need customers to be able to type in passwords, too) but I bet the backend system could also return an error.

Does that help?

[radazzouz]

@bryanjclark thanks buddy!

It does help us very much indeed! I'll be discussing your suggestions and recommendations with the rest of the team and I will comment back on this issue as soon as we have an update!

Best,

Rad