Zaki/Password-Manager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(sync): enforce strong sync password (§1.4/§4)

Browse Source 
The sync password is the only thing protecting the remote snapshot, but it
accepted 8 chars. Gate raised to 12+ chars AND computeStrength >= 50 (reused
from app.js — no zxcvbn dependency).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
r-zakarya
2026-07-09 21:52:51 +01:00
parent ddc24a5c56
commit c559e75310
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
js/app.sync.js
+6 -3
View File
@@ -124,13 +124,16 @@ async function syncSetEncPwdFlow() {
title: 'Set sync password', title: 'Set sync password',
message: 'Use the SAME password on every device that syncs with this remote. ' + message: 'Use the SAME password on every device that syncs with this remote. ' +
'Stored DPAPI-protected on this device only — never transmitted.', 'Stored DPAPI-protected on this device only — never transmitted.',
placeholder: 'At least 8 characters', placeholder: '12+ chars, mix letters/digits/symbols',
password: true, password: true,
okText: 'Save', okText: 'Save',
error: err, error: err,
}); });
if (!v) return; if (!v) return;
if (v.length >= 8) { // This password is the ONLY thing protecting the remote snapshot
// (§1.4) — enforce a real minimum. computeStrength reused from app.js
// (no zxcvbn dep). >=12 + one complexity category clears 50.
if (v.length >= 12 && computeStrength(v) >= 50) {
Bridge.setPref(SYNC_PREFS.encPwd, v); Bridge.setPref(SYNC_PREFS.encPwd, v);
const pwdStatus = document.getElementById('syncPwdStatus'); const pwdStatus = document.getElementById('syncPwdStatus');
if (pwdStatus) pwdStatus.textContent = 'Set.'; if (pwdStatus) pwdStatus.textContent = 'Set.';
@@ -139,7 +142,7 @@ async function syncSetEncPwdFlow() {
} }
n++; n++;
if (n >= 5) return toast('Too many invalid attempts', 'error'); if (n >= 5) return toast('Too many invalid attempts', 'error');
err = 'Use at least 8 characters (attempt ' + n + ' / 5).'; err = 'Too weak — use 12+ chars mixing letters, digits and symbols (attempt ' + n + ' / 5).';
} }
} }