FriendsOfFlarum Pwned Passwords

karaok

0.5.1

Allow guzzlehttp/guzzle v6.x or v7.x

IanM

0.6.0

Flarum beta 15 support

Ralkage

0.7.0 🔐

Updated for beta 16

Updating

composer require fof/pwned-passwords:"*"

Valeyard

Hi thanks for maintaining this extension. Do you think we could alter the wording a bit and provide a link on the error message so people actually know how the extension works? Or better still you could provide a way for the Flarum admin to change the error message in the settings and link to their own privacy page?

A lot of people when they read "The password you chose is registered in the Pwned Passwords database, please choose a different one" will draw incorrect conclusions, e.g. that I sent their password to a 3rd-party. I'd prefer a message like: "Your password failed a compromised database check."

Ralkage

Valeyard Do you think we could alter the wording a bit

This can currently be accomplished if you have fof/linguist installed 🙂 all relative translation keys for this extension can be found here for reference.

We do not currently have plans to add options to alter the wording via extension settings.

IanM

1.0.0

Flarum 1.0 ready

ash3T

Just want to check, what happens to me are normal.

If user A, use 12345678 as their password,

Then user B won't be register with 12345678 as password.

I thought this extension is meant to prevent A using the same password when A is changing password.

Thanks in advance for your attention. 😀

datitisev

ash3T This extension has nothing to do with users having the same password or changing to a previous password. This extension checks your password against an existing database of passwords exposed in data breaches, and prevents users from changing their password to one that has been in a data breach.

clarkwinkelmann

ash3T see David answer but just as an aside, what you describe isn't possible without compromising security.

To tell if a user is using the same password as another user would require not salting the password hashes, which opens you to Rainbow Table attacks if your database is ever stolen https://en.wikipedia.org/wiki/Rainbow_table

ash3T

clarkwinkelmann

datitisev

I see, thank you both for explanation.

louanbastos

I don't know if is a bug or not, but even changing the password to a different one, the message:

Your account's current password is registered in the Pwned Passwords database. We've sent a password reset email to you.

keep showing to me

clarkwinkelmann

louanbastos did you try a completely random password generated from a password manager?

The Pwned Passwords database contains a huge list of password, if it's not random there's a chance it's already in the database.

louanbastos

clarkwinkelmann I create a similar password for test, example, my previous password was abc123 and I changed to abc123@#. And keep showing to me my password as pwned.

louanbastos

clarkwinkelmann What website do you use to do/make the test?

Umutcan

louanbastos https://haveibeenpwned.com/

This can be.

clarkwinkelmann

Yes, password database is https://haveibeenpwned.com/Passwords . You can test the password over there to see if there's a difference of behavior with the extension.

To generate a random password for testing, most password managers and web browsers will offer to generate a password when you focus a password field, but otherwise you can use an online generator like DuckDuckGo's instant answer https://duckduckgo.com/?q=password+16+strong&ia=answer

louanbastos

clarkwinkelmann

I tested my password through the indicated link, and it wasn't leaked, unfortunately a long time ago my email was leaked, however, being a leaked email and password not being leaked, the message keeps showing up, and this is a little annoying.

HasanMerkit

louanbastos Same.. problem.....

2006bt

Hi. It seems to be a bug.
flarum.ERROR: Error: Call to undefined method Laminas\Diactoros\Response\EmptyResponse::getPayload() in /path/to/flarum/vendor/fof/pwned-passwords/src/Middleware/CheckLoginPassword.php:62 Stack trace: #0 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): FoF\PwnedPasswords\Middleware\CheckLoginPassword->process() #1 /path/to/flarum/vendor/fof/pwned-passwords/src/Middleware/PreventPwnedPassword.php(71): Laminas\Stratigility\Next->handle() #2 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): FoF\PwnedPasswords\Middleware\PreventPwnedPassword->process() #3 /path/to/flarum/vendor/fof/stopforumspam/src/Middleware/RegisterMiddleware.php(76): Laminas\Stratigility\Next->handle() #4 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): FoF\StopForumSpam\Middleware\RegisterMiddleware->process() #5 /path/to/flarum/vendor/fof/terms/src/Middlewares/RegisterMiddleware.php(59): Laminas\Stratigility\Next->handle() #6 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): FoF\Terms\Middlewares\RegisterMiddleware->process() #7 /path/to/flarum/vendor/fof/oauth/src/Middleware/ErrorHandler.php(50): Laminas\Stratigility\Next->handle() #8 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): FoF\OAuth\Middleware\ErrorHandler->process() #9 /path/to/flarum/vendor/flarum/core/src/Http/Middleware/ContentTypeOptionsHeader.php(21): Laminas\Stratigility\Next->handle() #10 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): Flarum\Http\Middleware\ContentTypeOptionsHeader->process() #11 /path/to/flarum/vendor/flarum/core/src/Http/Middleware/ReferrerPolicyHeader.php(30): Laminas\Stratigility\Next->handle() #12 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): Flarum\Http\Middleware\ReferrerPolicyHeader->process() #13 /path/to/flarum/vendor/flarum/core/src/Http/Middleware/FlarumPromotionHeader.php(30): Laminas\Stratigility\Next->handle() #14 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): Flarum\Http\Middleware\FlarumPromotionHeader->process() #15 /path/to/flarum/vendor/flarum/core/src/Http/Middleware/ShareErrorsFromSession.php(57): Laminas\Stratigility\Next->handle() #16 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): Flarum\Http\Middleware\ShareErrorsFromSession->process() #17 /path/to/flarum/vendor/flarum/core/src/Http/Middleware/CheckCsrfToken.php(44): Laminas\Stratigility\Next->handle() #18 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): Flarum\Http\Middleware\CheckCsrfToken->process() #19 /path/to/flarum/vendor/flarum/core/src/Http/Middleware/ResolveRoute.php(67): Laminas\Stratigility\Next->handle() #20 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): Flarum\Http\Middleware\ResolveRoute->process() #21 /path/to/flarum/vendor/flarum/core/src/Http/Middleware/SetLocale.php(51): Laminas\Stratigility\Next->handle() #22 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): Flarum\Http\Middleware\SetLocale->process() #23 /path/to/flarum/vendor/flarum/core/src/Http/Middleware/AuthenticateWithSession.php(31): Laminas\Stratigility\Next->handle() #24 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): Flarum\Http\Middleware\AuthenticateWithSession->process() #25 /path/to/flarum/vendor/flarum/core/src/Http/Middleware/RememberFromCookie.php(52): Laminas\Stratigility\Next->handle() #26 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): Flarum\Http\Middleware\RememberFromCookie->process() #27 /path/to/flarum/vendor/flarum/core/src/Http/Middleware/StartSession.php(61): Laminas\Stratigility\Next->handle() #28 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): Flarum\Http\Middleware\StartSession->process() #29 /path/to/flarum/vendor/flarum/core/src/Http/Middleware/CollectGarbage.php(46): Laminas\Stratigility\Next->handle() #30 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): Flarum\Http\Middleware\CollectGarbage->process() #31 /path/to/flarum/vendor/flarum/core/src/Http/Middleware/ParseJsonBody.php(28): Laminas\Stratigility\Next->handle() #32 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): Flarum\Http\Middleware\ParseJsonBody->process() #33 /path/to/flarum/vendor/flarum/core/src/Http/Middleware/HandleErrors.php(57): Laminas\Stratigility\Next->handle() #34 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): Flarum\Http\Middleware\HandleErrors->process() #35 /path/to/flarum/vendor/flarum/core/src/Http/Middleware/InjectActorReference.php(25): Laminas\Stratigility\Next->handle() #36 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): Flarum\Http\Middleware\InjectActorReference->process() #37 /path/to/flarum/vendor/fof/merge-discussions/src/Middleware/Redirection.php(28): Laminas\Stratigility\Next->handle() #38 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): FoF\MergeDiscussions\Middleware\Redirection->process() #39 /path/to/flarum/vendor/laminas/laminas-stratigility/src/MiddlewarePipe.php(75): Laminas\Stratigility\Next->handle() #40 /path/to/flarum/vendor/middlewares/request-handler/src/RequestHandler.php(84): Laminas\Stratigility\MiddlewarePipe->process() #41 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): Middlewares\RequestHandler->process() #42 /path/to/flarum/vendor/middlewares/base-path-router/src/BasePathRouter.php(101): Laminas\Stratigility\Next->handle() #43 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): Middlewares\BasePathRouter->process() #44 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Middleware/OriginalMessages.php(36): Laminas\Stratigility\Next->handle() #45 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): Laminas\Stratigility\Middleware\OriginalMessages->process() #46 /path/to/flarum/vendor/middlewares/base-path/src/BasePath.php(73): Laminas\Stratigility\Next->handle() #47 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): Middlewares\BasePath->process() #48 /path/to/flarum/vendor/flarum/core/src/Http/Middleware/ProcessIp.php(24): Laminas\Stratigility\Next->handle() #49 /path/to/flarum/vendor/laminas/laminas-stratigility/src/Next.php(49): Flarum\Http\Middleware\ProcessIp->process() #50 /path/to/flarum/vendor/laminas/laminas-stratigility/src/MiddlewarePipe.php(75): Laminas\Stratigility\Next->handle() #51 /path/to/flarum/vendor/laminas/laminas-stratigility/src/MiddlewarePipe.php(64): Laminas\Stratigility\MiddlewarePipe->process() #52 /path/to/flarum/vendor/laminas/laminas-httphandlerrunner/src/RequestHandlerRunner.php(96): Laminas\Stratigility\MiddlewarePipe->handle() #53 /path/to/flarum/vendor/flarum/core/src/Http/Server.php(44): Laminas\HttpHandlerRunner\RequestHandlerRunner->run() #54 /path/to/flarum/public/index.php(26): Flarum\Http\Server->listen() #55 {main}

clarkwinkelmann

Version 1.0.2

Fixed fatal errors when entering incorrect login credentials or when an extension prevents login
Fixed locked account alert not showing the link to send a new password
Use named routes, this makes the code more reliable in case another extension customizes Flarum routing
Updated javascript to Webpack 5 for small space saving

2006bt this should fix your issue. Thanks for the report!

Derbosik

clarkwinkelmann Class "Flarum\User\Command\RequestPasswordReset" not found in file /var/www/forum/vendor/fof/pwned-passwords/src/Middleware/CheckLoginPassword.php on line 73

« Previous Page Next Page »