by Sharif Mehedi · in Developers · assigned to Sharif Mehedi

Kokkuvõte

Children

Kommentaarid

• 7 kuud, 1 nädal ago by Sharif Mehedi about #6682 (Two step verification in lino) : I pushed some changes in lino, book and react.
• 7 kuud, 1 nädal ago by Luc Saffre about #6682 (Two step verification in lino) : @8lurry showed me his work. Cool! Well done! Right now it's implemented as a enable_two_factor_auth setting of the users plugin and supports only email verification. Maybe we should move it into a separate plugin in the future, if we also want to support Authenticator apps. But leave that for another time...
• 7 kuud, 1 nädal ago by Luc Saffre about #6682 (Two step verification in lino) : I guess that we should now have a look at django-otp.
• 7 kuud, 1 nädal ago by Luc Saffre about #6682 (Two step verification in lino) : I discovered that we already had a section Password validation ;-) I now added a first test case to it. @8lurry please add an example of a weak password that passes the validators.
• 7 kuud, 1 nädal ago by Luc Saffre about #6682 (Two step verification in lino) : Let's write a doctest about Django's default password validation, where we give some examples of weak passwords that make it through the AUTH_PASSWORD_VALIDATORS.
  
• 7 kuud, 1 nädal ago by Luc Saffre about #6682 (Two step verification in lino) : Yes, 2 step authentication is of course also a good feature to have.
• 7 kuud, 1 nädal ago by Sharif Mehedi about #6682 (Two step verification in lino) : We use it also on CreateUserRequest. So, it's good there. But even with the django's validate_password, it still takes relatively weak password.
  OTOH, it will be a good feature in lino to have two step verification. Who knows where else it might be useful.
• 7 kuud, 1 nädal ago by Luc Saffre about #6682 (Two step verification in lino) : Django has good password validators but oops, yes, it seems that we use validate_password() (from django.contrib.auth.password_validation) only in ChangePassword.
• 7 kuud, 1 nädal ago by Sharif Mehedi about #6682 (Two step verification in lino) : When Rasel created his account in pronto, he gave it a very simple password. And I got scared, thinking how I can protect these people. I think we should at least rely on their email, so that on every new device they should have to put an OTP received in their email.
• 7 kuud, 1 nädal ago by Sharif Mehedi about #6682 (Two step verification in lino) : Created new Ticket #6682 (Two step verification in lino).