BinarSkugga

It would also allow for using most likely pricey consultants to do it on the rare occasion this goes to court AND no flags were raised. I don't know really, the legal aspect of this is not my cup of tea.

@Falco I totally agree that it is the best way to catch every weak passwords because you're basically using the tools that define 'weakness' in this context. Still a lot more work than simply slapping a top 100k weak passwords list and checking for basic rules like length and diversity of characters. We could probably do an hybrid of both, using the cracking method only when we stored no flags, just as a final check.

Yes @Falco you can do this but it requires us to be up to date on technics to brute-force passwords. Realistically I try to use best practices in terms of security but have next to no experience in cracking passwords. Maybe it would be worth investing in resources that does this kind of stuff, I'm not sure. Its just not a price/time ratio I'm willing to look into.

@Nelson We've seen clients literally writing their password on a paper and sticking it on the laptop they use them on haha

@StianYttervik No password would be stored in clear anywhere. This would be done during the sign up and password change process on the fly. If we'd stored password in clear, I wouldn't need the flags since I could just compute them whenever needed. The password are never in clear at rest.

@James_pic yes you're right. We are looking into being compliant with data security. The issue is no matter how secure a platform is, it is only as secure as its user's willingness to have strong passwords. We could enforce super strict password constraints and long length but this bring up another issue. Maybe its because of our target audience but we'll have to reset those passwords OFTEN. The point of doing this is to reduce friction for our users and staying compliant. I'm not the one doing the compliance work but these flags would be encrypted and stored in another device completely.

Thanks for all the comments. I've been away from this question today. We are exploring ways to implement better security through MFA and our passwords are hashed using 6 rounds of salted Argon2id. The idea behind this is having less friction at login/signup. Of course I'm looking for a way to do this without creating an obvious weakspot. @Steffen Ullrich provided a nice alternative where the flag could be encrypted. This is not ideal from a security standpoint which is why I asked the question here. If this is a problem no matter the security around it, I'll review the business requirements.