<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>Obligatory xkcd: <a href="https://xkcd.com/936/">https://xkcd.com/936/</a></div><div><br></div><div>Password length is really the most important metric. Logging, and enforcing limits on login attempts are the second most important thing.</div><div><br></div><div>Anything that makes it harder for the user to use password managers or remember their password (like causing them to make a new password periodically) will cause them to either write their password down on a slip of paper, opening a security hole, or use the "password recovery" feature of your site a lot.<br><br>Really, if you want security, you want multi-factor auth: A password is something the user "knows". Send a validation code to a mobile phone, or use RSA key fobs, which are something the user "has". (to a lesser extent, sending an e-mail is another factor, but it's required that the user have secured that e-mail account well)</div><div><br></div><div>Also, as Chris Hamilton mentioned, MD5 must not be used for storing hashed passwords. Blowfish is the current best practice (to my knowledge).</div><div><br></div><div>Also, if you can avoid doing your own authentication altogether, delegating to an OAuth or OpenID provider (Facebook, Twitter, Github, StackExchange, etc...), then you don't have anything to worry about (cough)</div><div><br>Doug Bell<div><a href="mailto:preaction@me.com">preaction@me.com</a></div></div><div><br>On Aug 7, 2015, at 10:53 AM, Joel Limardo <<a href="mailto:joel.limardo@forwardphase.com">joel.limardo@forwardphase.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr"><div>If I'm not mistaken a strength meter tells the user 'hey..your password is weak' which doesn't *force* them to change the password *nor* does it tell them how to make a better one. As a rule of thumb, once you find yourself acting on more than one assumption it is a good sign that you have too many variables on hand to make a workable design. <br><br></div>I would instead a) force the user to enter a password of an appropriate length with certain characters like numbers and symbols b) periodically ask users to update their password (every 3 months, etc.) c) Disallow reuse of passwords (store MD5 hashes somewhere) d) check IP addresses to identify potential unauthorized access.<br><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Aug 7, 2015 at 9:35 AM, <span dir="ltr"><<a href="mailto:richard@rushlogistics.com" target="_blank">richard@rushlogistics.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I am using perl dancer to create a new user login page. I was surfing arround to try to find how to create a password strength meter when I found this <a href="http://www.perlmonks.org/?node_id=948997" rel="noreferrer" target="_blank">http://www.perlmonks.org/?node_id=948997</a> which has me second-guessing as to whether having one is even a good idea. Can anyone lend some insight in this matter and perhaps where to go get a good one if you believe they are a good idea?<br>
<br>
Thanks,<br>
<br>
Richard<br>
_______________________________________________<br>
Chicago-talk mailing list<br>
<a href="mailto:Chicago-talk@pm.org">Chicago-talk@pm.org</a><br>
<a href="http://mail.pm.org/mailman/listinfo/chicago-talk" rel="noreferrer" target="_blank">http://mail.pm.org/mailman/listinfo/chicago-talk</a><br>
</blockquote></div><br><br></div></div></div></div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Chicago-talk mailing list</span><br><span><a href="mailto:Chicago-talk@pm.org">Chicago-talk@pm.org</a></span><br><span><a href="http://mail.pm.org/mailman/listinfo/chicago-talk">http://mail.pm.org/mailman/listinfo/chicago-talk</a></span></div></blockquote></body></html>