Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Clef: Lack of Password Strength Check #17631

Closed
holiman opened this issue Sep 11, 2018 · 0 comments
Closed

Clef: Lack of Password Strength Check #17631

holiman opened this issue Sep 11, 2018 · 0 comments
Assignees
@holiman
Labels
area:clef

Comments

@holiman
Copy link
Contributor

holiman commented Sep 11, 2018

Ref: NCC-EF-Clef-005

Clef does not enforce password complexity checks on newly created accounts, accepting also empty passwords.

Todo:

  • Add complexity check, disallow weak passwords (at least NIST standards)
  • Add flag --devmode (or similar) to disable complexity check for when running in development mode
@holiman holiman self-assigned this Sep 11, 2018
holiman added a commit to holiman/go-ethereum that referenced this issue Sep 25, 2018
@holiman
signer,clef: default reject instead of warn + valideate new passwords. …
8e41a5c 
…fixes ethereum#17632 and ethereum#17631
holiman added a commit that referenced this issue Sep 25, 2018
@holiman
cmd/clef, signer: security fixes (#17554)
d3441eb 
* signer: remove local path disclosure from extapi

* signer: show more data in cli ui

* rpc: make http server forward UA and Origin via Context

* signer, clef/core: ui changes + display UA and Origin

* signer: cliui - indicate less trust in remote headers, see #17637

* signer: prevent possibility swap KV-entries in aes_gcm storage, fixes #17635

* signer: remove ecrecover from external API

* signer,clef: default reject instead of warn + valideate new passwords. fixes #17632 and #17631

* signer: check calldata length even if no ABI signature is present

* signer: fix failing testcase

* clef: remove account import from external api

* signer: allow space in passwords, improve error messsage

* signer/storage: fix typos
@holiman holiman closed this as completed Sep 25, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@holiman holiman

Labels
area:clef
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@holiman