Summary

This document reviews Tiki's current password strength implementation, evaluates potential enhancements, and provides a recommendation for integrating an improved password security solution. The primary goal is to establish strong, configurable password policies, ensure real-time user feedback that guides users towards creating secure passwords, and maintain security best practices without unnecessary complexity, primarily focusing on client-side implementation with consideration for backend enforcement.

Current Implementation Analysis

Overview

Tiki's password strength estimation is handled through client-side JavaScript, with additional server-side validation based on Tiki preferences.

Key templates involved:

• password_help.tpl: Displays password requirements (minimum length, character type, case sensitivity, repetition checks, and blacklist validation.)
• password_jq.tpl: Implements strength meter functionality

• Real-time strength meter with color-coded feedback, caps lock detection, password matching verification.

• Lacks robust pattern recognition and dictionary attack prevention.
• No comprehensive common password detection.
• Basic entropy calculation, primarily client-side.
• No integration with breach databases for real-time checks.
• Limited configurability of password policies within the client-side UX.

Library Comparison

Available Solutions

Solution	Stars	Downloads	Features	Pros	Cons
zxcvbn-ts/zxcvbn	4,500+	10M+	Pattern recognition, entropy calculation, common passwords	Industry standard, real-time feedback, strong pattern detection	Heavy (~500KB), lacks strict policy rule enforcement.
password-validator	1,500+	5M+	Configurable rules, character type checks, blacklist	Lightweight, highly configurable for policy enforcement	No pattern recognition, no entropy scoring.
check-password-strength	179	-	Visual strength meter, basic checks (length, character types), customizable	Simple to use, visually appealing, lightweight, customizable appearance	Potentially limited policy configuration, basic strength analysis.
Schuppo/password-strength	144	2M+	Simple validation rules, Laravel support	Lightweight, easy to implement	Limited analysis depth, basic validation.

Requirements Analysis

Must Have

• Client-side validation with real-time feedback to improve user experience.
• Configurable password policies for different client requirements, adaptable through Tiki's preferences system.
• Clear expression of password policies within the user interface.
• NIST compliance considerations and multi-language support.

Should Have

• Prevention of dictionary attacks and common password detection.
• Pattern recognition and breach database integration.
• Customizable strength feedback messages aligned with policy requirements.

Nice to Have

• Custom dictionary support for enhanced validation.
• Adaptive scoring system with optimized performance.

Recommendation

To achieve a balance between strong security, configurable policies, and a positive user experience, a primary solution for policy enforcement complemented by options for enhanced user feedback.
Primary Recommendation: password-validator for Configurable Policy Enforcement
password-validator is the best choice for enforcing specific and customizable password policies within Tiki. Its lightweight nature and focus on rule-based validation allow administrators to define precise password requirements (minimum length, required character sets, blacklists, etc.) through Tiki's preferences, which can then be enforced on the client-side.

Why password-validator?

• Highly Configurable Policies: Enables the definition of granular password rules.
• Lightweight: Minimal impact on client-side performance.
• Clear Policy Feedback: Can be used to provide specific feedback to users about unmet policy requirements, enhancing the UX.

Example Implementation:

Javascript

const passwordValidator = require('password-validator');
const schema = new passwordValidator();

schema
    .is().min(8)             // Minimum length
    .is().max(100)
    .has().uppercase()
    .has().lowercase()
    .has().digits(2)
    .has().not().spaces()
    .is().not().oneOf(['Passw0rd', '12345678']);

console.log(schema.validate('ValidPass123', { details: true }));

Options for Enhanced User Experience:

1. zxcvbn-ts (Advanced Strength Estimation): For an enhanced user experience that guides users towards creating even stronger passwords beyond the minimum policy requirements, consider integrating zxcvbn-ts. It provides real-time feedback and pattern recognition, helping users avoid easily guessable passwords. However, note its larger size.
2. check-password-strength (Simple Visual Meter): If a straightforward and visually appealing password strength meter is desired, check-password-strength offers a simple solution. It provides customizable visual feedback based on basic password characteristics and is easy to integrate.

Password Change Forms:

# Policy Configuration Retrieval: On password change forms, the client-side JavaScript will fetch the active password policy configuration.

# password-validator Implementation: The retrieved policies will be used to dynamically configure the validation rules in password-validator. This library will provide immediate feedback on policy compliance (e.g., displaying a list of unmet requirements).
# Optional UX Enhancement:
* zxcvbn-ts: Optionally integrate zxcvbn-ts in parallel to provide a real-time strength score and feedback, giving users a broader understanding of their password's security.

• check-password-strength: Alternatively, use check-password-strength to display a simple visual strength meter based on basic password characteristics.

# Backend Policy Enforcement: The same password policies configured in Tiki must also be enforced on the server-side during password creation and modification to ensure consistent security across the system.

Configuration Options

• Allow administrators to customize password policies (minimum length, required character types, blacklist, etc.) via Tiki’s preferences system.
• Ensure these policies are accessible to the client-side for dynamic configuration of the chosen JavaScript library.

References

1. NIST Password Guidelines
2. Zxcvbn Documentation
3. Tiki Development Guidelines
4. OWASP Password Storage Cheat Sheet
5. check-password-strength GitHub