2.1.9: Verify that there are no password composition rules limiting the type of characters permitted. There should be no requirement for upper or lower case or numbers or special characters.
The OWASP standard reflects our best practices around application security. You can see that there should be no password validator in a modern system. It's not a vulnerability, it's just old fashioned.
But the standards says also:
2.1.8: Verify that a password strength meter is provided to help users set a stronger password.
2.1.7: Verify that passwords submitted during account registration, login, and password change are checked against a set of breached passwords either locally (such as the top 1,000 or 10,000 most common passwords which match the system's password policy) or using an external API. If using an API a zero knowledge proof or other mechanism should be used to ensure that the plain text password is not sent or used in verifying the breach status of the password. If the password is breached, the application must require the user to set a new non-breached password.
发布评论
评论（1）
请在此处查看OWASP应用程序安全验证标准： https://github.com/owasp/asvs/raw/raw/raw/v4.0.3/4.0/owasp%20application%20security%20securification%20verification%20verification%20 standard%204.0.0.3-en.pdf
您会发现诸如：
2.1.9的要求：验证没有密码组成规则限制允许字符的类型。不需要上下案例或下案或特殊字符。OWASP标准反映了我们围绕应用程序安全的最佳实践。您可以看到现代系统中不应有密码验证器。这不是一个脆弱性，它只是老式的。
但是标准也说：
2.1.8：验证提供密码强度仪表以帮助用户设置更强的密码。2.1.7：验证在帐户注册期间提交的密码，登录，与密码更改相对于本地的一组违规密码（例如，与系统密码策略匹配的前1,000或10,000个最常见的密码）或使用外部API。如果使用API，则应使用零知识证明或其他机制来确保未发送或使用纯文本密码来验证密码的违规状态。如果违反密码，则应用程序必须要求用户设置新的非句子密码。，因此现代系统应提供其他内容。
Please have a look into OWASP Application Security Verification Standard available here: https://github.com/OWASP/ASVS/raw/v4.0.3/4.0/OWASP%20Application%20Security%20Verification%20Standard%204.0.3-en.pdf
You will find there requirements like:
2.1.9: Verify that there are no password composition rules limiting the type of characters permitted. There should be no requirement for upper or lower case or numbers or special characters.The OWASP standard reflects our best practices around application security. You can see that there should be no password validator in a modern system. It's not a vulnerability, it's just old fashioned.
But the standards says also:
2.1.8: Verify that a password strength meter is provided to help users set a stronger password.2.1.7: Verify that passwords submitted during account registration, login, and password change are checked against a set of breached passwords either locally (such as the top 1,000 or 10,000 most common passwords which match the system's password policy) or using an external API. If using an API a zero knowledge proof or other mechanism should be used to ensure that the plain text password is not sent or used in verifying the breach status of the password. If the password is breached, the application must require the user to set a new non-breached password.So modern systems should provide something else.