Strengthen password policy

[ignatiusm]

Strengthen Password Policy

All systems and applications should create a strong password policy including minimum lengths, deny-listing
of easy to guess ‘base’ words and contextual words, whenever user passwords are created.

The following guidelines are security best-practice recommendations when considering strong password
requirements:
• Passwords contain a minimum length of 14 characters.
• Password does not contain common ‘base’ words (i.e. Welcome, Changeme, Password).
• Password does not contain contextual words such as the user’s name or birthdate, or company name

[ignatiusm]

The last point (contextual words) may be trickier to implement as this context may not be available. Propose addressing first two points first and evaluating.

[ignatiusm]

Will require:

• Editing checkPasswordStrength function enforces new conditions
• Editing password tests check for new conditions
• Check frontend tests too
• Editing seed and test data to make sure seed and test password data is compliant with new conditions
• Display rules in frontend