lepture / safe

Is your password safe?

Safe

Is your password safe? Safe will check the password strength for you.

How it works

Safe will check if the password has a simple pattern, for instance:

1. password is in the order on your QWERT keyboards.
2. password is simple alphabet step by step, such as: abcd, 1357

Safe will check if the password is a common used password. Many thanks to Mark Burnett for the great work on 10000 Top Passwords.

Safe will check if the password has mixed number, alphabet, marks.

Installation

Install Safe with pip:

$ pip install Safe

If pip is not available, try easy_install:

$ easy_install Safe

Usage

It's very simple to check the strength of a password:

>>> import safe
>>> safe.check(1)
terrible
>>> safe.check('password')
simple
>>> safe.check('is.safe.password')
medium
>>> safe.check('x*V-92Ba')
strong
>>> strength = safe.check('x*V-92Ba')
>>> bool(strength)
True
>>> repr(strength)
'strong'
>>> str(strength)
'password is perfect'
>>> strength.valid
True
>>> strength.strength
'strong'
>>> strength.message
'password is perfect'

Environ Variables

1. PYTHON_SAFE_WORDS_CACHE: cache words in this file, default is a tempfile
2. PYTHON_SAFE_WORDS_FILE: words vocabulary file, default is the 10k top passwords

Other Implementations

1. JavaScript: lepture/safe.js

safe's Issues

There should be a way to bypass words-cache in order to avoid permissions issues

Hi,

I have several operating system users that can access my python environment and I would like to be able to import my code from all of them. When I try to import safe I face the following issue:

  File "/my_code", line X, in <module>
    import safe
  File "python2.7/site-packages/safe/__init__.py", line 68, in <module>
    WORDS = _load_words()
  File "python2.7/site-packages/safe/__init__.py", line 63, in _load_words
    with open(_cache_file, 'wb') as f:
IOError: [Errno 13] Permission denied: '/tmp/safe-0.4.words.cache'

I am able to bypass the issue by creating a temporary file every time so my new user can import and generates a new file.

try:
   import safe
except IOError:
   os.environ['PYTHON_SAFE_WORDS_CACHE'] = os.path.join(tempfile.gettempdir(),"safe-%s.words.cache" % time.time())
   import safe

That means it creates a different file:

testrunner@7b827fc0c77e:/code$ ls -lrt /tmp/
total 392
-rw-rw---- 1 userX userX 197151 Oct 29 16:06 safe-0.4.words.cache
-rw-rw---- 1 userY userY 197151 Oct 29 16:17 safe-1572365877.62.words.cache

I've been taking a look on the performance improvements on loading the cached file or not and in my use case the benefits are not worth it.

I would prefer to have a more secure environment, do not use pickle so no-one can execute arbitrary code in case someone modifies this file, instead of having the file of words cached. As the link shows in the documentation: Warning: The pickle module is not secure against erroneous or maliciously constructed data. Never unpickle data received from an untrusted or unauthenticated source.

I think Safe should allow a way of avoiding the cache to be generated or at least not do it on import time so the application doesn't fail in my use case.

I would be happy to work on a PR if that sounds a good idea and we can reach a design agreement.

Code duplicated

https://github.com/lepture/safe/blob/master/safe/__init__.py#L81 - L83

It seems that these code will never be executed because it is same as https://github.com/lepture/safe/blob/master/safe/__init__.py#L78

P.S. I made a go version implementation.