From c559e753105a14a185bff57ebe442cdd2f10baca Mon Sep 17 00:00:00 2001 From: r-zakarya <82443831+r-zakarya@users.noreply.github.com> Date: Thu, 9 Jul 2026 21:52:51 +0100 Subject: [PATCH] =?UTF-8?q?feat(sync):=20enforce=20strong=20sync=20passwor?= =?UTF-8?q?d=20(=C2=A71.4/=C2=A74)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The sync password is the only thing protecting the remote snapshot, but it accepted 8 chars. Gate raised to 12+ chars AND computeStrength >= 50 (reused from app.js — no zxcvbn dependency). Co-Authored-By: Claude Opus 4.8 --- js/app.sync.js | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/js/app.sync.js b/js/app.sync.js index 869d603..19c59fb 100644 --- a/js/app.sync.js +++ b/js/app.sync.js @@ -124,13 +124,16 @@ async function syncSetEncPwdFlow() { title: 'Set sync password', message: 'Use the SAME password on every device that syncs with this remote. ' + 'Stored DPAPI-protected on this device only — never transmitted.', - placeholder: 'At least 8 characters', + placeholder: '12+ chars, mix letters/digits/symbols', password: true, okText: 'Save', error: err, }); if (!v) return; - if (v.length >= 8) { + // This password is the ONLY thing protecting the remote snapshot + // (§1.4) — enforce a real minimum. computeStrength reused from app.js + // (no zxcvbn dep). >=12 + one complexity category clears 50. + if (v.length >= 12 && computeStrength(v) >= 50) { Bridge.setPref(SYNC_PREFS.encPwd, v); const pwdStatus = document.getElementById('syncPwdStatus'); if (pwdStatus) pwdStatus.textContent = 'Set.'; @@ -139,7 +142,7 @@ async function syncSetEncPwdFlow() { } n++; if (n >= 5) return toast('Too many invalid attempts', 'error'); - err = 'Use at least 8 characters (attempt ' + n + ' / 5).'; + err = 'Too weak — use 12+ chars mixing letters, digits and symbols (attempt ' + n + ' / 5).'; } }