Description:
To enhance account security and reduce the risk of unauthorized access due to weak or compromised credentials, we propose the addition of a password blacklist feature. This functionality would allow administrators to define a list of disallowed passwords that users cannot use when creating or updating their passwords.
Justification:
Many users continue to use common or previously compromised passwords, making accounts vulnerable to brute-force and dictionary attacks. By implementing a blacklist of insecure or expected passwords even with specified complexity (e.g., "123456", "password1234", "qwerty", or known leaked passwords), we can significantly improve the overall security posture of the system.
Suggested Implementation:
-
Allow administrators to configure a list of blacklisted passwords manually
