Hacktoberfest 2026：維護者為十月標記出來的 issue，仍然開放、適合新手。 瀏覽 Hacktoberfest issue

Password/Security overview

已關閉
  • 哪裡不對？
#89 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

維護者通常 1 天內回覆

還沒有人認領這個 Issue。

評估

難度
5/5
預估耗時
一週以上
新手友好度
28/100
Issue 類型
功能
描述清晰度
需要釐清
活躍度
活躍
技術堆疊
android, kotlin
領域
mobile-dev, security

研究方向

從 feature:item:create 中的 LoginRepository.observePasswordScores()、FilterUseCase 和 PasswordGenerator 開始；feature:autofill 展示了概覽可能如何依賴該模組。檢查 HIBP Pwned Passwords Range API 的要求，包括 k-匿名性和 Add-Padding 處理。直到結果儲存和進入點問題獲得解決後，這項工作才算完整定義；接著需要涵蓋所列出的所有概覽、重新產生和外洩檢查行為。

由索引模型根據 Issue 內容生成。

描述

A screen that gives an overview of how healthy the user's passwords are, and a quick way to fix weak ones.

Strength distribution

  • Chart showing how many logins fall into each score (Ridiculous, Weak, Moderate, Strong, Excellent)
  • Tapping a category opens the item list with that score filter applied
  • Logins without a password (PasswordScore.None) are not counted as weak

Scores are already stored unencrypted in password.password_score and exposed through LoginRepository.observePasswordScores(), so the chart needs no decryption. The list screen already filters by score (FilterUseCase), so the tap-through can reuse it instead of building a second list.

Scores are calculated when an item is saved (migrated v1 items keep their v1 score), so the chart is only as current as each item's last save.

Regenerate a weak password

The new password must never replace the working one before the user has actually changed it on the website. Otherwise a rejected or abandoned change locks them out.

  • Generate a new password and copy it. The old password stays saved
  • Open the service's website, if the login has one
  • Save the new password only after the user confirms the change worked
  • Quick options for length and symbols, since many sites reject some characters

PasswordGenerator lives in feature:item:create. The overview can depend on that module the way feature:autofill already does.

Breached passwords

Check passwords against the HIBP Pwned Passwords range API. It is free: no API key, no subscription, no attribution required (only HIBP's email and domain search APIs are paid). It uses k-anonymity, so only the first 5 characters of the password's SHA-1 hash ever leave the device.

  • Opt-in, off by default. Nothing is sent until the user enables it
  • Show breached logins as their own category, with a tap-through to the affected items
  • Breached logins can use the regenerate flow above
  • Send the Add-Padding: true header and discard padded rows (count 0)
  • Handle offline and failed requests without marking anything as safe

Health List

  • Sort by severity and within the group by alphanummerics
Open question: storing results

Re-check everything each time the screen opens, or persist a per-item result? A persisted flag would be readable without unlocking (like password_score), so it should either be encrypted or accepted as leaked metadata deliberately.

Open question: entry point

  • A navigation bar tab (next to Home, Connectivity, Settings), or
  • A summary card on Home ("4 weak passwords, Review") that opens the full screen

Out of scope (follow-up)

  • Reused passwords. Finding these means comparing plaintext, so either decrypt all passwords while unlocked or store a hash keyed from the ARK (never a plain hash). This is security-sensitive and needs its own design.
主要語言
Kotlin
星號
57
分支
12
平均合併
10 小時 17 分鐘
30 天內合併 PR
13

環境準備

這個專案沒有提供開發容器、Dockerfile 或貢獻指南，環境需要你自己搭建：先看它的 README，通用步驟見我們的新手貢獻指南。

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

OffRange/KeyGo 的其他 Issue

查看 OffRange/KeyGo 的全部 Issue

相似的 Issue

更多 Kotlin Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。