Enhance password security

[dandoug]

Password Security Recommendations

Based on my analysis of your Flask application using Flask-Security, here are comprehensive recommendations for enhancing password security:

1. Password Storage

Implement Strong Password Hashing

• Use Argon2id: Configure Flask-Security to use Argon2id as your primary password hashing algorithm, which is currently considered the most secure option
• Fallback Configuration: Maintain bcrypt as a fallback for compatibility
• Implementation:

  # In your app configuration
  SECURITY_PASSWORD_HASH = 'argon2'
  SECURITY_PASSWORD_SALT = 'your_secure_salt_here'  # Use a strong random value
  
  # Configure Argon2 parameters
  SECURITY_ARGON2_PARAMETERS = {
      'memory_cost': 16384,      # 16 MB
      'time_cost': 2,            # Number of iterations
      'parallelism': 2           # Number of parallel threads
  }

Secure Salt Management

• Use Environment Variables: Store your password salt in environment variables, not in code
• Unique Salt: Ensure each user has a unique salt component in addition to the global salt
• Salt Length: Use a salt of at least 16 bytes (128 bits)

2. Password Policies

Implement Strong Password Requirements

• Minimum Length: Require passwords to be at least 12 characters long
• Complexity: Require a mix of character types (uppercase, lowercase, numbers, special characters)
• Implementation:

  # Custom password validator for Flask-Security
  def password_validator(password, user=None):
      if len(password) < 12:
          return False
      if not any(c.isupper() for c in password):
          return False
      if not any(c.islower() for c in password):
          return False
      if not any(c.isdigit() for c in password):
          return False
      if not any(c in "!@#$%^&*()_-+={}[]|:;<>,.?/~`" for c in password):
          return False
      return True
  
  # In your app configuration
  SECURITY_PASSWORD_CHECK_BREACHED = True  # Check against known breached passwords
  SECURITY_PASSWORD_COMPLEXITY_CHECKER = password_validator

Password Blacklisting

• Common Password Check: Reject commonly used or easily guessable passwords
• Personal Information: Prevent passwords containing usernames or other personal information
• Implementation: Use a library like zxcvbn to evaluate password strength

3. Brute Force Protection

Implement Rate Limiting

• Login Attempts: Limit the number of failed login attempts
• Implementation:

  from flask_limiter import Limiter
  from flask_limiter.util import get_remote_address
  
  limiter = Limiter(
      app,
      key_func=get_remote_address,
      default_limits=["200 per day", "50 per hour"]
  )
  
  # Apply to login endpoint
  @limiter.limit("5 per minute")
  @app.route('/login', methods=['POST'])
  def login():
      # Your login logic

Account Lockout Policy

• Temporary Lockouts: Implement temporary account lockouts after multiple failed attempts
• Progressive Delays: Increase lockout duration with successive failures
• Implementation:

  # Configure Flask-Security lockout settings
  SECURITY_RECOVERABLE = True
  SECURITY_TRACKABLE = True
  SECURITY_CONFIRMABLE = True
  SECURITY_LOGIN_WITHIN = '1 days'  # Require login confirmation if inactive

4. Password Lifecycle Management

Password Expiration and History

• Regular Changes: Require password changes every 90-180 days (controversial but sometimes required for compliance)
• Password History: Prevent reuse of previous passwords (last 5-10)
• Implementation:

  # In your app configuration
  SECURITY_PASSWORD_EXPIRATION = 180  # Days
  SECURITY_PASSWORD_HISTORY = 5       # Number of previous passwords to check

Secure Password Reset

• Time-Limited Tokens: Ensure password reset tokens expire quickly (1 hour maximum)
• Single-Use Tokens: Invalidate tokens after first use
• Secure Delivery: Send reset links via authenticated email only
• Implementation:

  # In your app configuration
  SECURITY_RESET_PASSWORD_WITHIN = '1 hours'

5. Multi-Factor Authentication

Implement MFA Options

• Time-Based OTP: Implement TOTP (Time-based One-Time Password) authentication
• App Integration: Support authenticator apps like Google Authenticator or Authy
• Implementation:

  # Add Flask-Security-Too with two-factor authentication
  # pip install Flask-Security-Too[two_factor]
  
  # In your app configuration
  SECURITY_TWO_FACTOR = True
  SECURITY_TWO_FACTOR_REQUIRED = False  # Optional for users
  SECURITY_TWO_FACTOR_RESCUE_MAIL = 'admin@example.com'

Risk-Based Authentication

• Suspicious Activity: Require additional verification for suspicious login attempts
• New Devices/Locations: Prompt for additional verification when logging in from new devices or locations

6. Implementation and Testing

Security Headers

• Add Security Headers: Implement proper security headers for password-related pages

  @app.after_request
  def add_security_headers(response):
      response.headers['Content-Security-Policy'] = "default-src 'self'"
      response.headers['X-Content-Type-Options'] = 'nosniff'
      response.headers['X-Frame-Options'] = 'DENY'
      return response

By implementing these password security recommendations, you'll significantly enhance the security posture of your application and better protect your users' accounts from unauthorized access.

[dandoug]

see https://www.perplexity.ai/search/0690cdf4-67cd-4381-ab7d-01835142f48d for notes about implementing policy for role-based 2fa requirement.