History: Password Strength Implementation Review

! __Summary__

This document reviews Tiki's current password strength implementation, evaluates potential enhancements, and provides a recommendation for integrating an improved password security solution. The primary goal is to establish strong, configurable password policies, ensure real-time user feedback that guides users towards creating secure passwords, and maintain security best practices without unnecessary complexity, primarily focusing on client-side implementation with consideration for backend enforcement.


!! __Current Implementation Analysis__

!!! Overview
Tiki's password strength estimation is handled through client-side JavaScript, with additional server-side validation based on Tiki preferences. 

__Key templates involved:__
* __ [https://gitlab.com/tikiwiki/tiki/-/blob/master/templates/password_help.tpl|password_help.tpl]:__ Displays password requirements (minimum length, character type, case sensitivity, repetition checks, and blacklist validation.)
* __ [https://gitlab.com/tikiwiki/tiki/-/blob/master/templates/password_jq.tpl|password_jq.tpl]:__ Implements strength meter functionality

__User Interface__
* Real-time strength meter with color-coded feedback, caps lock detection, password matching verification.

__Limitations__
* Lacks robust pattern recognition and dictionary attack prevention.
* No comprehensive common password detection.
* Basic entropy calculation, primarily client-side.
* No integration with breach databases for real-time checks.
* Limited configurability of password policies within the client-side UX.

!!! Library Comparison

!!!! Available Solutions
{FANCYTABLE(head="Solution|Stars|Downloads|Features|Pros|Cons")}
[https://github.com/zxcvbn-ts/zxcvbn|zxcvbn-ts/zxcvbn]|4,500+|10M+|Pattern recognition, entropy calculation, common passwords|Industry standard, real-time feedback, strong pattern detection|Heavy (~500KB), lacks strict policy rule enforcement.
[https://github.com/tarunbatra/password-validator|password-validator]|1,500+|5M+|Configurable rules, character type checks, blacklist|Lightweight, highly configurable for policy enforcement|No pattern recognition, no entropy scoring.
[https://github.com/deanilvincent/check-password-strength|check-password-strength]|179|-|Visual strength meter, basic checks (length, character types), customizable|Simple to use, visually appealing, lightweight, customizable appearance|Potentially limited policy configuration, basic strength analysis.
[https://github.com/schuppo/PasswordStrengthPackage|Schuppo/password-strength]|144|2M+|Simple validation rules, Laravel support|Lightweight, easy to implement|Limited analysis depth, basic validation.
{FANCYTABLE}


!! Requirements Analysis

!!! Must Have
* Client-side validation with real-time feedback to improve user experience.
* Configurable password policies for different client requirements, adaptable through Tiki's preferences system.
* Clear expression of password policies within the user interface.
* NIST compliance considerations and multi-language support.

!!! Should Have
* Prevention of dictionary attacks and common password detection.
* Pattern recognition and breach database integration.
* Customizable strength feedback messages aligned with policy requirements.

!!! Nice to Have
* Custom dictionary support for enhanced validation.
* Adaptive scoring system with optimized performance.

!! Recommendation
To achieve a balance between strong security, configurable policies, and a positive user experience, a primary solution for policy enforcement complemented by options for enhanced user feedback.
__Primary Recommendation: password-validator__ for Configurable Policy Enforcement
password-validator is the best choice for enforcing specific and customizable password policies within Tiki. Its lightweight nature and focus on rule-based validation allow administrators to define precise password requirements (minimum length, required character sets, blacklists, etc.) through Tiki's preferences, which can then be enforced on the client-side.

__Why password-validator?__
* Highly Configurable Policies: Enables the definition of granular password rules.
* Lightweight: Minimal impact on client-side performance.
* Clear Policy Feedback: Can be used to provide specific feedback to users about unmet policy requirements, enhancing the UX.

!! Example Implementation:
Javascript 
{CODE()}
const passwordValidator = require('password-validator');
const schema = new passwordValidator();

schema
    .is().min(8)             // Minimum length
    .is().max(100)
    .has().uppercase()
    .has().lowercase()
    .has().digits(2)
    .has().not().spaces()
    .is().not().oneOf(['Passw0rd', '12345678']);

console.log(schema.validate('ValidPass123', { details: true }));
{CODE}

!!! Options for Enhanced User Experience:
__1. zxcvbn-ts (Advanced Strength Estimation):__  For an enhanced user experience that guides users towards creating even stronger passwords beyond the minimum policy requirements, consider integrating zxcvbn-ts. It provides real-time feedback and pattern recognition, helping users avoid easily guessable passwords. However, note its larger size.
__2. check-password-strength (Simple Visual Meter):__ If a straightforward and visually appealing password strength meter is desired, check-password-strength offers a simple solution. It provides customizable visual feedback based on basic password characteristics and is easy to integrate.

!!! Password Change Forms:
__# Policy Configuration Retrieval:__ On password change forms, the client-side JavaScript will fetch the active password policy configuration.

__# password-validator Implementation:__ The retrieved policies will be used to dynamically configure the validation rules in password-validator. This library will provide immediate feedback on policy compliance (e.g., displaying a list of unmet requirements).
__# Optional UX Enhancement:__
 * zxcvbn-ts: Optionally integrate zxcvbn-ts in parallel to provide a real-time strength score and feedback, giving users a broader understanding of their password's security.
* check-password-strength: Alternatively, use check-password-strength to display a simple visual strength meter based on basic password characteristics.
__# Backend Policy Enforcement: __The same password policies configured in Tiki must also be enforced on the server-side during password creation and modification to ensure consistent security across the system.

!!! Configuration Options
* Allow administrators to customize password policies (minimum length, required character types, blacklist, etc.) via Tiki’s preferences system.
* Ensure these policies are accessible to the client-side for dynamic configuration of the chosen JavaScript library.

{FANCYTABLE(head="Risk factor|Mitigation strategies")}
Performance impact|Use a lightweight primary library like password-validator (~4KB). Load zxcvbn-ts or check-password-strength conditionally or asynchronously.
Integration complexity|Select libraries with simple and well-documented APIs. Follow a progressive enhancement approach.
User frustration|Provide clear, specific, and real-time feedback on policy requirements and password strength.
Policy enforcement|Implement strict validation via password-validator on the client-side and mirror these policies on the server-side for robust enforcement.
{FANCYTABLE}

!! References

# [https://pages.nist.gov/800-63-3/sp800-63b.html|NIST Password Guidelines ]
# [https://github.com/dropbox/zxcvbn|Zxcvbn Documentation ]
# [https://dev.tiki.org/Development|Tiki Development Guidelines]
# [https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html|OWASP Password Storage Cheat Sheet]
#[https://github.com/deanilvincent/check-password-strength|check-password-strength GitHub]