Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We have many restraints we put on users when they set up their password. These restraints include password length, characters they can or cannot use, the use of numbers and letters, capitalization requirements, etc. These are enforced so a password cannot be created unless all restraints are met.

On a form that requires a user to log in with their password, should we be intercepting the password the user has provided and check it against our original restraints the user was required to follow when creating the password before sending it to LDAP for authentication.

I personally say besides basic data sanitation (to prevent SQL injection attacks, etc.) that there is no reason to check what the user provides as a password to log in after they've already created it. If it doesn't match, authentication will fail. However, other individuals in my department feel that those restraints should be checked again before sending the username/password combination to authenticate.

Which way is better? Why?

share|improve this question
add comment

3 Answers

up vote 7 down vote accepted

I'd recommend against it. If you want to protect from injection attacks, there are other, fundamentally better ways (e.g. prepared statements for SQL injection or correct escaping for other channels), besides the potentially malicious password will probably pass your restriction filters anyway (after all, you probably enforce minimum, not maximum password length, allow for ' character etc.)

Like Tom Leek said, it adds unnecessary complexity. If you want to enforce password change due to new restrictions taking place, you need to do this after authentication anyway, so you could store the 'password isn't good anymore' flag in session, but the validity check should be an addition to authentication process and not be done before sending the password to LDAP.

share|improve this answer
add comment

Checking again an already registered password is useful IF the rules you want to enforce have changed AND you have the possibility to make the user change his password so that the new one complies with the new rules. Otherwise it is a waste of time, and added complexity (complexity is Bad).

share|improve this answer
add comment

should we be intercepting the password the user has provided and check it against our original restraints the user was required to follow when creating the password before sending it to LDAP for authentication.

To what end? This is one more feature to get wrong and leak information. How much benefit can this feature provide for how much it costs to get right, iron out bugs, and deal with unforeseen issues that lock out customers?

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.