Update minimum password length requirements

[techknowlogick]

No description provided.

[wxiaoguang]

I do not think it really makes sense, for example: 12345678 perfectly matches MIN_PASSWORD_LENGTH = 8

To make the password secure, it needs more rules.

[KN4CK3R]

Rules aren't really helping. We could add a "password strength meter" like https://github.com/dropbox/zxcvbn to show how secure a password is.

Reasonable Password Policy Example

• Passwords must be at between 12 and 4,096 characters in length.
• Passwords can contain any characters (including Unicode).
• We strongly encourage the use of a password manager to generate and store your passwords.
• Your password strength must be at least level 3 (on the 0-4 scale).

That's it. Don't tell people what their password can or cannot contain. Don't refuse longer passwords. Do stop people from shooting themselves in the foot, but don't interfere beyond what's necessary to prevent foot-bullets.

[wxiaoguang]

IMO the "password strength meter" is also "rule-based" (scoring rules, date rules, variation rules, etc) 🤣

And one more thing, even if some passwords are likely safe, but they are already in the password dict, so sometimes pwned-check is also necessary (well, it depends ....)

But I think making the password checking too complex is not in Gitea's scope, in most cases, SSO and 2FA are better solutions.

[KN4CK3R]

Yes, just want to prevent rules like "must contain 2 lower, 3 middle and 4 upper case letters". Then as user you think "wtf are middle letters?".

[wxiaoguang]

There are already some simple builtin rules:

;;Comma separated list of character classes required to pass minimum complexity.
;;If left empty or no valid values are specified, the default is off (no checking)
;;Classes include "lower,upper,digit,spec"
;PASSWORD_COMPLEXITY = off

And even:

;; Validate against https://haveibeenpwned.com/Passwords to see if a password has been exposed
;PASSWORD_CHECK_PWN = false

I think that's enough for daily usage (with 2FA).

The real problem is: make users set the values they like during their installation ......

[jolheiser]

There are already some simple builtin rules:

;;Comma separated list of character classes required to pass minimum complexity.
;;If left empty or no valid values are specified, the default is off (no checking)
;;Classes include "lower,upper,digit,spec"
;PASSWORD_COMPLEXITY = off

And even:

;; Validate against https://haveibeenpwned.com/Passwords to see if a password has been exposed
;PASSWORD_CHECK_PWN = false

I think that's enough for daily usage (with 2FA).

The real problem is: make users set the values they like during their installation ......

In general I agree with this, however not every user sees an installation page. Many deploy from packages or other "auto" installations that provide a minimal working config and perhaps don't check it.

I also very much agree that 12345678 isn't secure, but it's arguably "better:tm:" than 123456, but that boils down to a human/user problem. I think increasing minimum length, while not perfect, is likely better on average than "complexity".

(Obligatory I am not a security expert 😅)

[silverwind]

Can do more later

[silverwind]

e2e test failure may be related.

[techknowlogick]

@silverwind thanks :) I've updated e2e tests, and they are now passing.