Settings has a new Passwords section with an "Allow weak passwords" checkbox. It is off in a new profile. Only a stored true turns it on, as for "Use Blockscout".
While it is off, AddWallet refuses a password shorter than 12 characters, with the same error as before.
While it is on, AddWallet accepts any password that is not empty.
An empty password is refused either way.
src/shared/vault.js is untouched, so key derivation is unchanged.
README describes the setting under Settings and AddWallet. Key Decisions states the Argon2id parameters and why they are light. The user guide lists the setting under Settings.
What the diff does not show
AddWallet is the only screen that sets a password. Nothing else calls encryptWithPassword().
The checkbox is saved the way "UTC Timestamps" is. A popup that is already open keeps its own copy of the setting until it is reopened.
The new test file, tests/allowWeakPasswords.test.js, boots the real popup, sets the checkbox in Settings and adds a wallet. It mocks the vault.
Prettier rewrapped one paragraph under AddWallet's Transitions. Only its first sentence changed.
Disclosures
Judgement call: the hint line above the password fields names no length today, so it stays the same with the setting on or off.
Judgement call: the screens say "password", as README's wording rules require. So the checkbox reads "Allow weak passwords" and the stored field is allowWeakPasswords.
Model: opus-5-5
Implements https://git.eeqj.de/sneak/AutistMask/issues/674.
**What changed**
- Settings has a new Passwords section with an "Allow weak passwords" checkbox. It is off in a new profile. Only a stored `true` turns it on, as for "Use Blockscout".
- While it is off, AddWallet refuses a password shorter than 12 characters, with the same error as before.
- While it is on, AddWallet accepts any password that is not empty.
- An empty password is refused either way.
- `src/shared/vault.js` is untouched, so key derivation is unchanged.
- README describes the setting under Settings and AddWallet. Key Decisions states the Argon2id parameters and why they are light. The user guide lists the setting under Settings.
**What the diff does not show**
- AddWallet is the only screen that sets a password. Nothing else calls `encryptWithPassword()`.
- The checkbox is saved the way "UTC Timestamps" is. A popup that is already open keeps its own copy of the setting until it is reopened.
- The new test file, `tests/allowWeakPasswords.test.js`, boots the real popup, sets the checkbox in Settings and adds a wallet. It mocks the vault.
- Prettier rewrapped one paragraph under AddWallet's Transitions. Only its first sentence changed.
**Disclosures**
- Judgement call: the hint line above the password fields names no length today, so it stays the same with the setting on or off.
- Judgement call: the screens say "password", as README's wording rules require. So the checkbox reads "Allow weak passwords" and the stored field is `allowWeakPasswords`.
Model: opus-5-5
Settings gains a Passwords section with an "Allow weak passwords" checkbox. It
is off in a new profile, and only a stored true turns it on. While it is off,
AddWallet refuses a password shorter than 12 characters, as before. While it is
on, AddWallet accepts any password that is not empty. Key derivation is
unchanged.
The README describes the setting under Settings and AddWallet. Its Key
Decisions section now states the Argon2id parameters and why they are light.
The user guide lists the setting under Settings.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Implements #674.
What changed
trueturns it on, as for "Use Blockscout".src/shared/vault.jsis untouched, so key derivation is unchanged.What the diff does not show
encryptWithPassword().tests/allowWeakPasswords.test.js, boots the real popup, sets the checkbox in Settings and adds a wallet. It mocks the vault.Disclosures
allowWeakPasswords.Model: opus-5-5
Review: PASS
Model: opus-5-5