Default Support for HIBP

[discobot]

People have a terrible habit of using the same password over and over and often times have no clue the password they use isn’t safe anymore. It’s also a common oversight to add this by most creators. Add a Setting to enable/disable of course.

Have I Been Pwned: API v2

---

Read-only archive: https://petitions.classicpress.net/posts/63/default-support-for-hibp

Author: Dustin Snider

Vote count: 9

Status: open

Tags:

• request-add-feature

---

Comments

I was chatting about this here: https://vote.classicpress.net/posts/39/please-add-enforce-strong-passwords-and-password-expiry-to-the-core

I think it is a great idea to support HIBP by default.

~ posted by Wade Striebel

I’m generally of the mindset that if a plugin can handle it then it should but this seems like an underlying added layer of security not only for the site itself but also the end user. I’m not one for bloating the core hence why I came to ClassicPress.

~ posted by Dustin Snider

Seems more a plugin territory and also create an issue of privacy because we share the email of the user to a different server.

~ posted by Daniele Scasciafratte

No, a correct implementation of HIBP does not share any information about the user or the password to a different server.

If we implement this, we need to think about what happens if HIBP goes down one day.

Otherwise I think this should be a core feature.

~ posted by James Nylen

[viktor]

I’ve used this as part of the Shield Security plugin. It’s a nice feature, definitely would be nice to have in the core. But can be easily done as a plugin.

Do you still think this should be in the core @james ?

I think this could be a good feature for our Security page, letting admin set site-wide settings and enforce them for all users.

The few options that make sense to offer:

• Enforcement mode:
  • Notify - will notify user but not require new password
  • Require - will require user to pick a new password

And we might want to offer bulk option to select users and perform HIBP check.

[james]

Yes, this has my vote as a basic measure to improve password security.

An implementation should probably start as a research plugin anyway, and then evaluation of whether it should be included in core would happen separately.

[ozfiddler]

Might be worth looking at forking an existing plugin? These are 2 that I found…

Passwords Evolved

Disallow Pwned Password

[viktor]

Bcrypt support would be nice. Although not under this petition. We implement it on all client sites we host.

[viktor]

Do you know if it’s still possible to use HIBP without paying? Looks like he added authentication and pricing in 2019.

[james]

The way we would use HIBP (searching based on the SHA-1 hash of a proposed password) is still free: https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByRange

GET https://api.pwnedpasswords.com/range/{first 5 hash chars}

Elsewhere on that page:

Authorisation is required for all APIs that enable searching HIBP by email address,

Searching based on password hash is not such an API, so it does not require authorisation/authentication.

We would probably still want to set up a proxy service for HIBP where we have sites query api-v1.classicpress.net and store the results on our servers. This would allow us to minimize the number of calls to their servers and also respond with an error if that service becomes unavailable at some point in the future.

[ozfiddler]

@james

GET https://api.pwnedpasswords.com/range/{first 5 hash chars}

The second plugin above uses this method. Looks like it will work for us (both CP and CC) as is.

Minimum requirements

• PHP v7.0
• WordPress v4.9.8
• (Optional) WooCommerce v3.4.4

[timkaye]

I use bcrypt on all my sites too. I did open a PR for it soon after CP first started, but it didn’t get implemented because of a theoretical edge case which I’ve never seen occur. I’m wondering whether it might be worth looking at argon2 now instead; that doesn’t have the same theoretical edge case.

[viktor]

Thanks for reminding me of this. I remember that petition now. Let’s have that discussion there, that’s a tree that needs shaking.

Hash passwords with bcrypt instead of md5

WP uses md5 with key stretching to hash passwords. This is moderately secure, but using bcrypt instead would be significantly more secure. (Argon2 might be even better, but I have no experience with it, whereas I have been using bcrypt for a couple of years, so I know it works fine.) WP hasn’t done this because it supports PHP versions lower than 5.5. Since we have already agreed to drop support for versions of PHP below 5.6, we should be in a position to implement this. See http://php.net/manu…

[viktor]

Thanks, that’s good to know.

For reference, this is how Shield Security implements it: