Difference between revisions of "OWASP Passfault"

Demo Site

Does the Demo Site capture or log passwords?

No, of course not

How can I be sure the Demo Site doesn't capture or log passwords?

You can't, There is no way to verify what is uploaded to appspot (google is hosting the demo site) However, you can look at the code: https://github.com/c-a-m/passfault/blob/master/jsonService/src/main/java/org/owasp/passfault/web/PassfaultServlet.java We took the following steps to ensure the passwords don't get logged:

• GETs are blocked so no urls will have accidental passwords stored in the logs
• passwords are read directly from the input stream to prevent parsing into Java Strings
• the memory is cleared as soon as analysis is complete.
• HTTPS is required on this URL (using the appspot domain)

To be extra cautious, download the code and execute it locally. (See the readme) https://github.com/c-a-m/passfault/blob/master/README.txt

Volunteers

OWASP Passfault is developed by a worldwide team of volunteers. The primary contributors to date have been:

• Cam Morris
• New Jersey Institute of Technology students contributed to release 0.8 (Highlander):
  • Michael Glassman
  • Georgina Matias
  • Scott Sands
  • Brandon Lyew
  • Kevin Sealy
  • Llina Ljoljevski
• University of Florida Students contibuted to release 0.7 (Gator):
  • Neeti Pathak
  • Carlos Vasquez
  • Chelsea Metcalf
  • Yang Ou

Others

• Partnet Inc. has donated paid labor on OWASP Passfault

Release 0.8

Goal: preparation for ESAPI

• More meaningful word lists
  • Frequency lists: build lists of the most common words, names. (Done for English, Spainish)
  • Improved configuration of finders and wordlists

Release 0.9

• UI improvements
• Fix backlog of issues
• experiment with configuration of wordlists

Release 1.0

Goals: Enterprise Ready - UI improvements for learning better password strategies - Easier to configure and run, not requiring a developer to wire things up.

Other Important Goals

• Javascript library generated by GWT and GWT Export. Do you know GWT? Please help us build a javascript version of passfault using GWT Exporter: https://code.google.com/p/gwt-exporter/
• OS system integration:
  • Linux
    • running passwd on linux runs passfault
    • apt-get install passfault
  • Windows
• Document each pattern finder on the OWASP wiki.
• JQuery Plugin: A JQuery plugin that will let a web site use either the passfault applet or a passfault JSON Service to analyze a password.
• Wordlists: We can always use better word lists. Contact us on the mailing list if you want to help.

For current bugs and smaller tasks see the issues list on github: https://github.com/c-a-m/passfault/issues?state=open