<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Thanks Peter!</div><div><br></div><div>It's on our radar:</div><div><br></div><div><a href="https://github.com/mozilla/fxa-auth-server/issues/222">https://github.com/mozilla/fxa-auth-server/issues/222</a></div><div><br></div><div>I prefer discussion of actionable techniques/ideas to take place there, but feel free to rock on here.</div><div><br></div><div>-chris</div><div><br></div><div><br></div><div>I'd prefer the discussion to take place in that issue.</div><br><div><div>On Nov 21, 2013, at 9:04 AM, Peter deHaan <<a href="mailto:pdehaan@mozilla.com">pdehaan@mozilla.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">For those of you not blessed to be sitting in the vicinity of jrgm and myself...<br><br>GitHub weak passwords brute forced: [1]<br>"This is a great opportunity for you to review your account, ensure that you have a strong password and enable two-factor authentication."<br><br><br>Other fascinating topics of conversation recently have revolved around the big password leaks at Adobe (now available as a crossword puzzle; [2]), which nicely ties in to "Facebook requires some users to change password after Adobe hack" [3][4]<br><br>A couple open-ish questions for the larger team are:<br><br>- Should FxA enforce that passwords are not "weak" and not in the top X commonly used passwords? [5] Note that we're not just telling people that their password is weak or strong, but specifically rejecting their attempts to use a password of "password" or "123456" or "letmein", or "121212". Amazingly *24* of the top 100 most common passwords [5] are strictly numeric!<br>- Is there a way for us to recognize possibly compromised common passwords and force users to change them, similar to what Facebook did?<br>- Should/can we support two-factor authentication (a la Dropbox, Twitter, Evernote, GitHub, Gmail, etc)?<br>- Not a question really, but jrgm is in huge support of lloyd's "lockdown" module for enforcing dependencies [6]. I can file bugs in the various fxa-* repos to eventually lock down the dependencies before v1 release if we're not already using it.<br><br>-peter<br><br>[1] <a href="https://github.com/blog/1698-weak-passwords-brute-forced">https://github.com/blog/1698-weak-passwords-brute-forced</a><br>[2] <a href="http://zed0.co.uk/crossword/">http://zed0.co.uk/crossword/</a><br>[3] <a href="http://www.theverge.com/2013/11/12/5095560/facebook-requires-users-to-change-password-after-adobe-hack">http://www.theverge.com/2013/11/12/5095560/facebook-requires-users-to-change-password-after-adobe-hack</a><br>[4] <a href="http://krebsonsecurity.com/2013/11/facebook-warns-users-after-adobe-breach/">http://krebsonsecurity.com/2013/11/facebook-warns-users-after-adobe-breach/</a><br>[5] <a href="http://stricture-group.com/files/adobe-top100.txt">http://stricture-group.com/files/adobe-top100.txt</a><br><br><br>----- Forwarded Message -----<br>From: "Edwin Wong" <<a href="mailto:edwong@mozilla.com">edwong@mozilla.com</a>><br>To: "Peter deHaan" <<a href="mailto:pdehaan@mozilla.com">pdehaan@mozilla.com</a>><br>Cc: <a href="mailto:services-qa-staff@mozilla.com">services-qa-staff@mozilla.com</a><br>Sent: Wednesday, November 20, 2013 9:42:14 PM<br>Subject: Re: FxA and security stuff<br><br>i'd push this email to dev-fxacct list<br><br>we need to plan for 2 factor auth and blacklisting top passwds asap.<br><br>yes, we need lockdown<br><br><br>-e<br>_______________________________________________<br>Dev-fxacct mailing list<br><a href="mailto:Dev-fxacct@mozilla.org">Dev-fxacct@mozilla.org</a><br>https://mail.mozilla.org/listinfo/dev-fxacct<br></blockquote></div><br></body></html>