Tag: password

This is a translatable password validator for Django, based on zxcvbn-python and available with seed. zxcvbn is a password strength estimator inspired by password crackers. This prevents users from having to choose a password with a capital letter, a special character and a number, while checking the strength of the password and providing an entry to help the user to access the password. choose a password.

The project is available here on Github, and the package is on Pypi here.

I check the code with the pre-commit frame, using black, I sort, flake8 and pylint like hooks. I test it with tox and blanket locally, and I've put it in place travis and codacy online. The translation is done with Django Rosetta. I've tried to create a clear readme file with examples to explain what the package does in detail. There are also tests that fully cover the code base.

I would be very interested in the remarks about the project as a whole, the code, the tests, the documentation, the tools, the configuration, the design, the complexity of the integration and, basically, anything that could improve the project.

But that's a lot of things to review so the main part of the code is:

from the django.conf import settings
from django.core.exceptions import ImproperlyConfigured, ValidationError
of django.utils.translation import ugettext_lazy as _
since zxcvbn import zxcvbn

from django_zxcvbn_password_validator.settings import DEFAULT_MINIMAL_STRENGH
from the import django_zxcvbn_password_validator.translate_zxcvbn_text (
translate_zxcvbn_text,
translate_zxcvbn_time_estimate,
)


ZxcvbnPasswordValidator class:
def __init __ (self, min_length = 1, zxcvbn_implementation = zxcvbn):
self.min_length = min_length
self.zxcvbn_implementation = zxcvbn_implementation
self.password_minimal_strengh = getattr (
parameters, "PASSWORD_MINIMAL_STRENGH", DEFAULT_MINIMAL_STRENGH
)
self .__ check_password_minimal_strengh ()

def __check_password_minimal_strengh (auto):
error_msg = "ZxcvbnPasswordValidator needs an integer between 0 and 4"
error_msg + = "for PASSWORD_MINIMAL_STRENGH in the settings."
if int (self.password_minimal_strengh)! = self.password_minimal_strengh:
error_msg + = f "(not a {self.password_minimal_strengh .__ class __.__ name__})"
raises ImproperlyConfigured (error_msg)
if self.password_minimal_strengh < 0 or self.password_minimal_strengh > 4:
error_msg + = f "({self.password_minimal_strengh} is not in [0,4]) "
raises ImproperlyConfigured (error_msg)

def validate (auto, password, user = none):
def add_list_of_advices (header, comments, tips):
if isinstance (advice, str):
comments.append (f "{header}: {translate_zxcvbn_text (tips)}")
other:
for advice on advice:
comments.append (f "{header}: {translate_zxcvbn_text (hint)}")
send comments

user_imputs = []
        if user:
for the value in the user .__ dict __. values ​​():
user_imputs.append (value)
results = self.zxcvbn_implementation (password, user_inputs = user_imputs)
password_strengh = results["score"]
        if password_strengh <self.password_minimal_strengh:
crack_time = results["crack_times_display"]
            offline_time = crack_time["offline_slow_hashing_1e4_per_second"]
            warnings = results["feedback"]["warning"]
            
            
            
            tips = results["feedback"]["suggestions"]
            
            
            
            comments = []
            comments.append (
"{} {}". format (
_ ("Your password is too easy to guess:"),
_ ("It would take an offline attacker% (time) s to guess it.")
% {"time": translate_zxcvbn_time_estimate (offline_time)},
)
)
if warnings:
comments = add_list_of_advices (_ ("Warning"), comments, warnings)
if advice:
comments = add_list_of_advices (_ ("Tips"), comments, tips)
raises ValidationError (comments)

def get_help_text (auto):
expectations = _ ("we wait")
if self.password_minimal_strengh == 0:
expectations + = "{}". format (
_ ("nothing: you can use the password you want.")
)
back expectations
expectations + = "{}". format (_ ("a password that can not be guessed"))
hardness = {
1: _ ("by your family or friends."),
2: _ ("by online attackers."),
3: _ ("without access to our database."),
4: _ ("without a dedicated team and access to our database."),
}
expectations + = "{}". format (hardness.get (self.password_minimal_strengh))
returns the format "{} {} {} {}". (
_ ("There is no specific rule for a good password,"),
_ ("however, if your password is too easy to guess"),
_ ("we will tell you how to make a better one."),
expectations
)

The translation is done here:

import registration

of django.utils.translation import ugettext_lazy as _

LOGGER = logging.getLogger (__ file__)


def translate_zxcvbn_text (text):
"" "This PR would make it cleaner, but it will also be very slow
be integrated with python-zxcvbn and we want it to work now:
https://github.com/dropbox/zxcvbn/pull/124 "" "
i18n = {
"Use a few words, avoid common expressions": _ (
"Use a few words, avoid common expressions"
)
"No need for symbols, numbers, or uppercase letters": _ (
"No need for symbols, numbers or capital letters"
)
"Add another word or two.Rare words are better.": _ (
"Add another word or two, unusual words are better."
)
"The rows of straight keys are easy to guess": _ (
"The rows of straight keys are easy to guess"
)
"Short keyboard models are easy to guess": _ (
"Short keyboard patterns are easy to guess"
)
"Use a longer keyboard model with more turns": _ (
"Use a longer keyboard model with more turns"
)
& # 39; Repetitions like "aaa" are easy to guess:
"Repetitions like" aaa "are easy to guess"
)
& # 39; Repetitions like "abcabcabc" are only slightly more difficult to guess than "abc": _ (
Repetitions like "abcabcabc" are only slightly more difficult to guess than "abc" & # 39;
)
"Avoid words and repeated characters": _ ("Avoid words and repeated characters"),
& # 39; Sequences like "abc" or "6543" are easy to guess ": _ (
"Sequences like" abc "or" 6543 "are easy to guess"
)
"Avoid sequences": _ ("Avoid sequences"),
"The last years are easy to guess": _ ("The last years are easy to guess"),
"Avoid the last years": _ ("Avoid the last years"),
"Avoid the years associated with you": _ (
"Avoid the years associated with you"
)
"Dates are often easy to guess": _ ("Dates are often easy to guess"),
"Avoid dates and years associated with you": _ (
"Avoid dates and years associated with you"
)
"This is a common password of the top 10": _ ("This is a common password of the top 10"),
"This is a common password of the top 100": _ ("This is a common password of the top 100"),
"This is a very common password": _ ("This is a very common password"),
"It looks like a commonly used password": _ (
"This is similar to a commonly used password"
)
"A word in itself is easy to guess": _ ("A word in itself is easy to guess"),
"Names and names by themselves are easy to guess": _ (
"Names and names by themselves are easy to guess"
)
"Common names and first names are easy to guess": _ (
"The names and surnames are easy to guess"
)
"Capitalization does not help much": _ (
"Capitalization does not help much"
)
"The upper case is almost as easy to guess as the lower case": _ (
"All capital is almost as easy to guess as everything in lowercase"
)
"Inverse words are not harder to guess": _ (
"Inverse words are not harder to guess"
)
"Predictable substitutions like" @ "instead of" a "do not help much": _ (
"Predictable substitutions like" @ "instead of" a "do not help much"
)
}
translate_text = i18n.get (text)
if translate_text is None:
# zxcvbn is inconsistent, sometimes there is a dot, sometimes not
translate_text = i18n.get (text[:-1])
if translate_text is None:
LOGGER.warning (
"No translations for"% s "or"% s ", update the generatei18ndict command.",
text,
text[:-1],
)
return text
return translate_text


def translate_zxcvbn_time_estimate (text):
def replace_dict (text, times):
for original, translated into times.items ():
text = text.replace (original, str (translated))
return text

if text == "less than one second":
return _ ("less than one second")
text = text.replace ("centuries", str (_ ("centuries")))
plural_times = {
"seconds": _ ("seconds"),
"minutes": _ ("minutes"),
"hours": _ ("hours"),
"days": _ ("days"),
"month": _ ("month"),
"years": _ ("years"),
}
times = {
"second": _ ("second"),
"minute": _ ("minute"),
"hour": _ ("hour"),
"day": _ ("day"),
"month": _ ("month"),
"year": _ ("year"),
}
# Plural first to avoid replacing "hours" with _ ("hour") + s
# Add a & # 39; s & # 39; does not mean plural in all languages
text = replace_dict (text, plural_times)
text = replace_dict (text, times)
return text

This part of the code is mainly generated by the following management command (made in case zxcvbn add a string or delete a string to make it easier to create a new translation):

# - * - coding: utf-8 - * -

from django.core.management.base import BaseCommand


Command class (BaseCommand):

help = "Generate what i18n says for translate_zxcvbn_text"

def handle (self, * args, ** options):
existings_messages = [
            "Use a few words, avoid common phrases",
            "No need for symbols, digits, or uppercase letters",
            "Add another word or two. Uncommon words are better.",
            "Straight rows of keys are easy to guess",
            "Short keyboard patterns are easy to guess",
            "Use a longer keyboard pattern with more turns",
            'Repeats like "aaa" are easy to guess',
            'Repeats like "abcabcabc" are only slightly harder to guess than "abc"',
            "Avoid repeated words and characters",
            'Sequences like "abc" or "6543" are easy to guess',
            "Avoid sequences",
            "Recent years are easy to guess",
            "Avoid recent years",
            "Avoid years that are associated with you",
            "Dates are often easy to guess",
            "Avoid dates and years that are associated with you",
            "This is a top-10 common password",
            "This is a top-100 common password",
            "This is a very common password",
            "This is similar to a commonly used password",
            "A word by itself is easy to guess",
            "Names and surnames by themselves are easy to guess",
            "Common names and surnames are easy to guess",
            "Capitalization doesn't help very much",
            "All-uppercase is almost as easy to guess as all-lowercase",
            "Reversed words aren't much harder to guess",
            "Predictable substitutions like '@' instead of 'a' don't help very much",
        ]
        msg = "i18n = {"
for the message in existings_messages:
message = message.replace ("& # 39;", "\ & # 39;")
msg + = f "{message}" _ ("message"), "
msg + = "}"
msg + = "Please copy and paste the following in translate_zxcvbn_text,"
msg + = "Then use 'python manage.py makemessages'."
print (msg)

That's all the code, everything else consists of tests, documentation or packaging.

Thank you in advance for your remarks or advice!