Check new user passwords against database of pwned passwords

[nhoening]

We have one password strength test: to be at least 8 characters long.

I suggest to try a feature in flask-security.

Add this to utils/config_defaults.py:

SECURITY_PASSWORD_CHECK_BREACHED = "best-effort" # will try to check https://api.pwnedpasswords.com

Then, add a new user, and when going to the reset-pwd dialgoue (check mail via mailhog for the link), try a password like "testtest" and see if that is flagged, and how the user sees that.

[nhoening]

This setting should be set to None in the testing config (same file, at the bottom), so our tests can use "testtest" for simplicity.

Also, we might want to set SECURITY_PASSWORD_BREACHED_COUNT higher than the default (1)

[joshuaunity]

Also, we might want to set SECURITY_PASSWORD_BREACHED_COUNT higher than the default (1)

I am thinking we set this to 3, what do you think?

[nhoening]

Also, we might want to set SECURITY_PASSWORD_BREACHED_COUNT higher than the default (1)

I am thinking we set this to 3, what do you think?

Yes, let's go with that