OktaSecurityLabs / passprotect-js

A simple JavaScript library to help you protect your users' passwords

Home Page:https://www.passprotect.io

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

'Unsafe password detected' alert should identify its source

filbo opened this issue · comments

Running PassProtect 0.1.8 on Opera (opera-developer 63.0.3340.0).

I entered an 'unsafe password' (in fact I had just typed 1 letter into a password field when I realized I didn't want to be entering it at all, so I clicked on another part of the page, thus triggering the 'end of password' processing). The resulting box reads:

Unsafe password detected!

The password you just entered has been found in 89,650 data
breaches. This password is not safe to use.

This means attackers can easily find this password online and
will often try to access accounts with it.

If you are currently using this password, please change it
immediately to protect yourself. For more information, visit
Have I Been Pwned?

This notice will not show again for the duration of this session
to give you time to update this password.

[ I UNDERSTAND ]

(image included below).

I had installed PassProtect months ago; and since I don't use crummy passwords, it had never popped up. Its sudden appearance was startling and disconcerting: I couldn't tell where it was coming from. Was it a new feature in Opera? Built into this new router that was just installed? Oh yeah -- I think I installed an extension ... yep, there it is, and if I disable it this message doesn't pop up when I try a different 1-letter password. So that's the source.

Basically: please add a source identification to this popup!

Something like:

ALERT from PassProtect browser extension (www.passprotect.io)

Unsafe password detected!

. . .

image