You Shall Not Pass
summary
Moodle gets a password-policy plugin that rejects dictionary words, sequential digits, user-identifying data and compromised credentials by checking the SHA-1 prefix against the HaveIBeenPwned API; the plugin is open source and used NIST guidance. The platform gains an authentication-layer with hooks at hard breakpoints so MFA can be injected for password changes, resets and SSO flows. Factors include TOTP, email, trusted IP networks and idP-derived assurances; implementation details cover rate‑limits, minimal info leakage and stacking multiple factors.
AI-written summary · about
chapters (19)
- 0:00Intro
- 1:31What is it?
- 2:02Some history
- 3:29Efforts to increase security in pain points.
- 4:26Password standards
- 7:31Have I Been Pwned
- 8:41Dictionary checks
- 9:52Identifying information
- 10:34Apply this anywhere
- 11:16So that's what we did
- 12:09A look at authentication flow
- 12:32Moodle account authentication
- 13:27Existing solutions
- 14:28Interface layer
- 15:28The patching process
- 17:36MFA overview
- 18:45MFA design considerations
- 20:04Lessons we learned
- 22:11Final thoughts
related talks
30mhunter2: A Symphony of Password Horror
40mFantastic Passwords and Where to Find Them
46mRequiem for the Password
31mhunter2: A Symphony of Password Horror
51mYou Shall Not Password: Modern Authentication for Web Apps
55mYou Shall Not Password: Modern Authentication for Web Apps
34mThe Path of Secure Digital Identity
23mFantastic Passwords and Where to Find Them