Page MenuHomeMiraheze

Improve password standards
Closed, ResolvedPublic

Description

Latest standards say passwords should be 12-128 charecters. I've added suggested dates if we're happy with it.

I'd like to roll this out by doing it in stages:

  • Set max to 128 (2nd August)
  • Set sysadmin,ts,steward groups to 12 minimum (9th August)
  • Require for above to login (20th August)
  • Set admin,crat,bot to 12 minmum (23rd August)
  • Require for above to login (3rd September)
  • Set all users to 12 minimum (6th September)
  • Require for above to login (17th September

Event Timeline

RhinosF1 triaged this task as Normal priority.Jul 29 2021, 13:27

I'll create announcements before doing this

Hello all,

Over the next 6 weeks, We will be slowly increasing password requirements to require passwords are between 12 and 128 characters. This is to comply with the latest security standards.

The maximum password length will affect everyone from Monday but the change to minimum lengths will hit users who hold admin, crat or bot on any wiki from the week commencing August 23rd and all users from the week commencing September 6th.

You will start seeing notices when using your account from the start of the week and the change will prevent you logging in by the Friday of the week after.

Please ensure you change your password if affected by the dates above and set an email so you can reset your password if logins are stopped.

If you have any feedback, comment below.

Thanks, ~~~~

I'm not certain I would reduce the maximum (currently 4096). In theory, the only problem with having a password longer than 128 characters is potential server load.

In T7713#155094, @Void wrote:

I'm not certain I would reduce the maximum (currently 4096). In theory, the only problem with having a password longer than 128 characters is potential server load.

It comes from 2.1.1 and 2.1.2 of https://github.com/OWASP/ASVS/blob/v4.0.2/4.0/en/0x11-V2-Authentication.md#v21-password-security-requirements

Owen subscribed.

No objections raised by me.

In T7713#155094, @Void wrote:

I'm not certain I would reduce the maximum (currently 4096). In theory, the only problem with having a password longer than 128 characters is potential server load.

It comes from 2.1.1 and 2.1.2 of https://github.com/OWASP/ASVS/blob/v4.0.2/4.0/en/0x11-V2-Authentication.md#v21-password-security-requirements

See also https://github.com/OWASP/ASVS/issues/756#issuecomment-867078439 . But at the same time there also isn't really a strong reason why we shouldn't. We can move forward with this, but I would be comfortable dropping the 128 max in favor of 4096 if there is community pushback.

I strongly doubt that anyone has a >128 charecter password.

I agree with Void in that dropping the maximal doesn’t make a lot of sense when it’s already set at that level by default. You’d need a good reason really to lower it and a standard that chose the length based on software we don’t use doesn’t seem it.

I'll create announcements before doing this

I strongly support this. ↗️

I don't have any issues with the maximum 128 characters, but I do have issues with the proposed 12 character minimum. I also have issues with the accelerated timeline and why this is proposed for users who do not have any advanced global groups (i.e., non-system administrators, non-stewards, etc.). Even if Wikimedia requires it for sysop and bureaucrat, you have to remember we're not Wikimedia, so those user groups are a lot less sensitive.

Unknown Object (User) moved this task from Backlog to In Progress on the Configuration board.Aug 3 2021, 07:12
Unknown Object (User) moved this task from Backlog to Short Term on the MediaWiki (SRE) board.
Unknown Object (User) moved this task from Unsorted to Short Term on the Universal Omega board.Aug 3 2021, 07:15
Reception123 removed a subscriber: Unknown Object (User).Aug 24 2021, 19:05

There seems to have been limited engagement with the post so I think it will probably be best to post again and maybe provide more of an explanation for why this is necessary.

@Agent_Isai - this might be your territory now. Might be good to engage with @RhinosF1

Unknown Object (User) assigned this task to Agent_Isai.Nov 9 2021, 23:58

Bumped the CN thread (which had been long since archived) and pinged @Announcement Pings/published the announcement on Discord for more maximum visibility. Hope to do more later tonight.

After 10+ days of the Community noticeboard topic being reopened, it seems we've gotten an ample amount of comments regarding this.

It seems the original post did not cite what password standards were being referenced which made users disbelieve there was any backing for this.It appears that out of all the comments on there, there were 3 opposes and 7 supports though the supports all varied in degrees. Of the 7 supports, 3 only supported a password minimum for global groups, 1 supported though suggested a password minimum of 8 characters, and 1 supported it for all groups that have 'destructive' permissions (i.e. sysops and bureaucrats) but not so much for casual users.

There appears to be no consensus for this matter and additionally, I am unable to find anything that backs up our claim that 12 characters is the new recommended standard and it appears that the definition of global groups is not defined either. I think another Request for Feedback should be done if we choose to further pursue this with more information to back up our claim and better clarity.

Since we have already tried to get this through, I think we should probably wait a while before attempting to push through this change again.

As regarding global groups, we could potentially consider implementing the change since as far as I'm aware most people in the global groups currently support the change. (though not everyone has been asked)

Unknown Object (User) added a comment.Dec 5 2021, 04:50

I personally think that for local groups and normal users this should be declined, and only done for global groups. I don't really feel the community didn't necessarily give consensus. To me the consensus was given to opposition of the change for everything except global groups. I also don't believe normal users nor local groups absolutely necessary to be increased. We are currently using the modern standards for this and I don't think we need to change that. This all just opinion though. I also don't think we should ask the community again, that would be like we don't really care they didn't want it the first time, we're going to keep pestering the community until it has a supporting consensus. Asking once is enough unless new evidence comes up to be presented. However in the meantime I do think this task should be declined for local users, and only done for global groups.

Unknown Object (User) added a comment.Dec 5 2021, 05:01

And this is already done for most global groups actually (well set to 10, on all except global sysops and interwiki-admins). We could raise them all from 10 to 12 though, and add GS in, I'm not certain interwiki-admin is really as necessary.

Agent_Isai added a subscriber: Unknown Object (User).EditedDec 5 2021, 05:19

And this is already done for most global groups actually (well set to 10, on all except global sysops and interwiki-admins). We could raise them all from 10 to 12 though, and add GS in, I'm not certain interwiki-admin is really as necessary.

Global sysops hold an immense amount of power with centralauth-lock in their toolset, I think they should also have their password requirement raised. As for Interwiki administrators, they do hold the power to change the interwiki table of any wiki (excluding Meta's, which is the global interwiki table). You could argue they could maliciously change a local IW table if compromised to redirect, say the m prefix from linking to Meta to some fake website, and no one would notice but well, that's stretching it a bit and we could probably skip them.

Unknown Object (User) added a comment.Dec 5 2021, 05:27
This comment was removed by Unknown Object (User).
Unknown Object (User) closed this task as Resolved.Dec 5 2021, 20:51
Unknown Object (User) claimed this task.

Global groups done, As that is all that was supported by the community, closing this task as resolved.