Hello everybody What is the default value for

max_breaches

?

Looking at the code, it’s 0. https://github.com/ory/kratos/blob/master/driver/config/config.go#L1361 (if the value is not supplied, the config library returns 0).

Max value 100 😂

Thank you @bland-eye-99092

LOL! I don’t think there is a practical reason for that

Where did you get this file which is in the image that tells you about all the configuration?

@bland-eye-99092 circling back to this. I noticed in our Ory Network project identity configs, that

max_breaches

is set to

1

by default. Does this mean that the password is allowed to have been in one breach?

yes that’s correct. Not sure why we have it on 1 🤔 You can set it to 0, to disallow any breached passwords.

Ok, I’ll go through my projects and set them all to

0

. I think it would be a good idea to make that the default for any new project. We had a pen tester tell us that the “leaked password check didn’t seem to be functioning”. So it could be that, or I’m wondering if due to the

ignore_network_errors: true

, they overwhelmed the system or something and the passwords weren’t being checked properly. I’ll try to get more info.

I think it would be a good idea to make that the default for any new project.

Agreed. Thanks for pointing this out.

I’ll try to get more info.

That would be great.

I just set

max_breaches

to

0

, and now there is no longer a value in the identity-config used to be

"password": {
  "config": {
    "haveibeenpwned_enabled": true,
    "identifier_similarity_check_enabled": true,
    "ignore_network_errors": true,
    "max_breaches": 1,
    "min_password_length": 10
  },
  "enabled": true
},

But now is

"password": {
  "config": {
    "haveibeenpwned_enabled": true,
    "identifier_similarity_check_enabled": true,
    "ignore_network_errors": true,
    "min_password_length": 10
  },
  "enabled": true
},

Can you please verify that the value is

0

now?

Yes, if it’s not rendered it falls back to 0. https://github.com/ory/kratos/blob/master/driver/config/config.go#L1362 You should be able to verify by registering with “test123” for example.

thanks