halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 40 Packages Wiki Activity Actions

fix(keys): new passwords have at least 12 characters

Browse source 
The register can't check a password it never sees, and should its
database leak, the verifier and the keys wrapped under the password fall
to guessing at Argon2id's cost (the second reading's M8). Devices now
refuse a new password shorter than 12 characters, counted as code points
once normalised (halkyon_keys' checkNewPassword), at sign-up, a reset
keeping the keys and a change alike, before anything is derived; the new
password's field says so, and the refusal has its own text (en, de).
Signing in takes any length, so a password set before keeps working.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-20 21:25:47 +02:00
commit b33b99a50a
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 216 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

12
packages/halkyon_app/lib/l10n/halkyon_app_localizations.dart
View file

@ -1344,6 +1344,18 @@ abstract class HalkyonAppLocalizations {
/// In en, this message translates to:
/// **'Couldn\'t reach the instance. Check the connection and try again.'**
String get passwordFailed;
/// No description provided for @passwordMinLength.
///
/// In en, this message translates to:
/// **'At least {count} characters'**
String passwordMinLength(int count);
/// No description provided for @passwordTooShort.
///
/// In en, this message translates to:
/// **'A new password needs at least {count} characters: should the instance\'s database ever leak, a short one is guessed first.'**
String passwordTooShort(int count);
}
class _HalkyonAppLocalizationsDelegate