Page MenuHomePhabricator

Create PasswordCannotMatchEmail password policy
Open, Needs TriagePublic

Description

A password policy for PasswordCannotMatchEmail to go with PasswordCannotMatchUsername seems a reasonable mitigation/prevention

Event Timeline

I think it was not added because email is not public like username (and not even required).

I think it was not added because email is not public like username (and not even required).

Neither is your password?

@Reedy is this still relevant? It seems similar to includes/password/PasswordPolicyChecks.php L95 checkPasswordCannotBeSubstringInUsername()

I'm looking for a good first contribution and this would be a good fit.

@Tonymetz: A good first task is a self-contained, non-controversial task with a clear approach. It should be well-described with pointers to help a completely new contributor. Please add details what exactly has to happen where and how for a new contributor, and then add back the good first task project tag. Thanks a lot in advance!

thanks for the guidance I may take this one. I'll improve the docs if it's better suited for the tag. I appreciate the guidance.