a
/
gosora
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

clarify how the weak password scanner works

This commit is contained in:
Azareal 2020-06-19 13:18:44 +10:00
parent 2c220c47df
commit 470003665b
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docs/weak_passwords.md
View File

@ -4,6 +4,8 @@ For configuring the list of weak passwords and weak password detection rules, we
There are two sections: `contains` and `literal`. `contains` scans the password to see if a specified piece of text is in it and `literal` checks if the password matches the specified rule exactly (with some exceptions). There are two sections: `contains` and `literal`. `contains` scans the password to see if a specified piece of text is in it and `literal` checks if the password matches the specified rule exactly (with some exceptions).
All passwords are converted to lowercase form before either scanner is ran on them to detect common tricks like capitalizing the first letter.
`contains` is slower and may not scale with a large number of rules, but it is more effective at finding certain patterns which a password cracker could exploit to crack someone's password. `contains` is slower and may not scale with a large number of rules, but it is more effective at finding certain patterns which a password cracker could exploit to crack someone's password.
`literal` is very inflexible and only matches rules literally. With two exceptions, the password fed to it is in lowercase form, so common variants like capitalizing the first letter will be detected. Sticking a number at the end of the common literal will also be detected. `literal` is very inflexible and only matches rules literally. One exception is that it will remove numbers from the end of the password running the rule.