mozilla/browserid — Issue #837: Change password UI allows entry of password length < 8
Author: jrgm
Created: 2012-01-04 06:23:36+00:00
State: open

Change password UI allows entry of password length < 8

Steps to reproduce:
1) Go to diresworb.org
2) Sign in with an existing account (or sign up for a new one).
3) After signin/signup reload (if needed) to get the "Account Manager" UI
4) In the password section, click Edit
5) Enter current password for Old, and any string less than 8 char as New
6) click Done (UI accepts this short password)
7) Sign out then Sign in with the short password
8) It works. You are logged in.

So, the 8 char restriction that is done at initial signup
(static/shared/validation.js?) is not enforced in the wsapi/update_password
stuff, I assume. (1 character password is allowed in IE9(Vista/Win7), and
FF9/Chrome/Safari(OSX))

(Side note: often "change password" screens require a double entry of the new
password to avoid typos. That's not this bug. Just wondering if that's an
intentional choice to not do have the same in browserid UI.)