Stronger passwords

[partomas]

Hello i have two requests:
1. the ability to set mandatory passwords with spec characters, not only numbers and letters as it is now.
2. To enable control if users password fits pasw requirements and if no, to force upgrade password.

It's important for bigger amount of regular and portal users management.

[yuri]

Hi,

> To enable control if users password fits pasw requirements and if no, to force upgrade password.

I think this is not feasible for two reasons.

1. It's not possible to know which characters are in a stored password as it's hashed.
2. Storing information about a password is not good for security. For example, the database is stolen. Find out which passwords are weak. Try to brute force them first.

[yuri]

Note that password length is more important than complexity. You can also consider increasing the min. password length. Also it's highly recommended to force regular users to set up 2FA.

[partomas]

Note that password length is more important than complexity. You can also consider increasing the min. password length. Also it's highly recommended to force regular users to set up 2FA.

Yes, I know, but in our ISO requirements there are rule that all passwords should include specific characters and I have no way how to implement that requirement.

[partomas]

And one more thing to the same topic, the "frequency of password change" setting is needed to ensure the users at least once a yer would change their credentials to new one.