From: Lucas Werkmeister <mail@lucaswerkmeister.de>
Date: Wed, 15 Jun 2016 09:26:25 +0000 (+0200)
Subject: Update notes about password security
X-Git-Url: https://code.wpia.club/?p=gigi.git;a=commitdiff_plain;h=30d832c49af804fc3fad6a9c24bdbb7debf4f978

Update notes about password security

The current implementation of the PasswordStrengthChecker does not
require any particular character set, as the old text implied. Nor is
whitespace truncation implemented at all. The new text, suggested by
BenBE, is more generally phrased.

Change-Id: I40be6a9e1bddce1d233ca8752301fe71c6447226
---

diff --git a/src/org/cacert/gigi/pages/PasswordResetForm.templ b/src/org/cacert/gigi/pages/PasswordResetForm.templ
index 61e1c2b4..1d12004d 100644
--- a/src/org/cacert/gigi/pages/PasswordResetForm.templ
+++ b/src/org/cacert/gigi/pages/PasswordResetForm.templ
@@ -18,7 +18,7 @@
     <td><input type="password" name="pword2"></td>
   </tr>
   <tr>
-    <td colspan="2"><span class="formMandatory">*</span><?=_Please note, in the interests of good security, the pass phrase must be made up of an upper case letter, lower case letter, number and symbol (all white spaces at the beginning and end are removed).?></td>
+    <td colspan="2"><span class="formMandatory">*</span><?=_Your password is one of many factors to protect your account from unauthorised access. A good password is hard to guess, long, and contains a diverse set of characters. Learn more in our !'<a href="http://wiki.cacert.org/wiki/FAQ" target="_new">'FAQ!'</a>'.?></td>
   </tr>
   <tr>
     <td colspan="2"><input type="submit" name="process" value="<?=_Update Pass Phrase?>"></td>
diff --git a/src/org/cacert/gigi/pages/account/ChangePasswordForm.templ b/src/org/cacert/gigi/pages/account/ChangePasswordForm.templ
index d4588989..33f349f7 100644
--- a/src/org/cacert/gigi/pages/account/ChangePasswordForm.templ
+++ b/src/org/cacert/gigi/pages/account/ChangePasswordForm.templ
@@ -18,7 +18,7 @@
     <td><input class="form-control" type="password" name="pword2"></td>
   </tr>
   <tr>
-    <td colspan="2"><span class="formMandatory">*</span><?=_Please note, in the interests of good security, the pass phrase must be made up of an upper case letter, lower case letter, number and symbol (all white spaces at the beginning and end are removed).?></td>
+    <td colspan="2"><span class="formMandatory">*</span><?=_Your password is one of many factors to protect your account from unauthorised access. A good password is hard to guess, long, and contains a diverse set of characters. Learn more in our !'<a href="http://wiki.cacert.org/wiki/FAQ" target="_new">'FAQ!'</a>'.?></td>
   </tr>
   <tr>
     <td colspan="2"><input type="submit" name="process" value="<?=_Update Pass Phrase?>"></td>
diff --git a/src/org/cacert/gigi/pages/main/RegisterPage.templ b/src/org/cacert/gigi/pages/main/RegisterPage.templ
index c792985a..fbf084d1 100644
--- a/src/org/cacert/gigi/pages/main/RegisterPage.templ
+++ b/src/org/cacert/gigi/pages/main/RegisterPage.templ
@@ -6,6 +6,5 @@
 <?=_Your private information will be used for internal procedures only and will not be shared with third parties.?>
 </p>
 <p style="border:dotted 1px #900;padding:0.3em;background-color:#ffe;">
-<?=_A proper password wouldn't match your name or email at all, it contains at least 1 lower case letter, 1 upper case letter, a number, white space and a misc symbol. You get additional security for being over 15 characters and a second additional point for having it over 30. The system starts reducing security if you include any section of your name, or password or email address or if it matches a word from the english dictionary...?><br><br>
-<b><?=_Note: White spaces at the beginning and end of a password will be removed.?></b>
+<?=_Your password is one of many factors to protect your account from unauthorised access. A good password is hard to guess, long, and contains a diverse set of characters. Learn more in our !'<a href="http://wiki.cacert.org/wiki/FAQ" target="_new">'FAQ!'</a>'.?>
 </p>
diff --git a/src/org/cacert/gigi/pages/main/Signup.templ b/src/org/cacert/gigi/pages/main/Signup.templ
index cef5a309..59e22cd4 100644
--- a/src/org/cacert/gigi/pages/main/Signup.templ
+++ b/src/org/cacert/gigi/pages/main/Signup.templ
@@ -53,7 +53,7 @@
   </tr>
 
   <tr>
-    <td colspan="3"><font color="red">*</font><?=_Please note, in the interests of good security, the pass phrase must be made up of an upper case letter, lower case letter, number and symbol.?></td>
+    <td colspan="3"><font color="red">*</font><?=_Your password is one of many factors to protect your account from unauthorised access. A good password is hard to guess, long, and contains a diverse set of characters. Learn more in our !'<a href="http://wiki.cacert.org/wiki/FAQ" target="_new">'FAQ!'</a>'.?></td>
   </tr>
   <tr>
     <td colspan="3"><?=_It's possible to get notifications of up and coming events and even just general announcements, untick any notifications you don't wish to receive. For country, regional and radius notifications to work you must choose your location once you've verified your account and logged in.?></td>