Simplify default password policy

* Remove PasswordNotInLargeBlacklist => false, it's a no-op
* Deduplicate PasswordCannotMatchUsername
* Remove PasswordCannotBePopular. There is no point in using both
  PasswordCannotBePopular (top 10K passwords from SecLists) and
  PasswordNotInLargeBlacklist (top 100K passwords from SecLists),
  and the CDB lookup is probably not that cheap.

Change-Id: I868846931988b88f06800e42861e82e2bb0bc427

diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index b78da06..7f0f59d 100644 (file)
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -4500,28 +4500,21 @@ $wgPasswordPolicy = [
                'bureaucrat' => [
                        'MinimalPasswordLength' => 10,
                        'MinimumPasswordLengthToLogin' => 1,
-                       'PasswordCannotMatchUsername' => true,
-                       'PasswordCannotBePopular' => 25,
                        'PasswordNotInLargeBlacklist' => true,
                ],
                'sysop' => [
                        'MinimalPasswordLength' => 10,
                        'MinimumPasswordLengthToLogin' => 1,
-                       'PasswordCannotMatchUsername' => true,
-                       'PasswordCannotBePopular' => 25,
                        'PasswordNotInLargeBlacklist' => true,
                ],
                'interface-admin' => [
                        'MinimalPasswordLength' => 10,
                        'MinimumPasswordLengthToLogin' => 1,
-                       'PasswordCannotMatchUsername' => true,
-                       'PasswordCannotBePopular' => 25,
                        'PasswordNotInLargeBlacklist' => true,
                ],
                'bot' => [
                        'MinimalPasswordLength' => 10,
                        'MinimumPasswordLengthToLogin' => 1,
-                       'PasswordCannotMatchUsername' => true,
                        'PasswordNotInLargeBlacklist' => true,
                ],
                'default' => [
@@ -4529,7 +4522,6 @@ $wgPasswordPolicy = [
                        'PasswordCannotMatchUsername' => true,
                        'PasswordCannotMatchBlacklist' => true,
                        'MaximalPasswordLength' => 4096,
-                       'PasswordNotInLargeBlacklist' => false,
                ],
        ],
        'checks' => [