Enforce strong passwords in UI

[SuaYoo]

Resolves #1233

Changes

• Enforces password with minimum zxcvbn score of 3 on org join, password reset, and user account settings pages
• Shows suggestions returned from zxcvbn. Only supports english at this time
• Login/sign-up form size tweaks to accommodate longer help text
• Re-order display name entry and password on org join form so that password feedback is closer to submit button

Out-of-scope change: made name required so that reorder makes sense, and also so that we don't have to deal with displaying long email addresses in the UI. cc @Shrinks99 @ikreymer

Manual testing

Test password input works as expected on following pages:

• Org join
• Account settings
• Password reset

Screenshots

Page	Image/video
Sign-up/Join
Password reset
Password Input - Unacceptable scores 0-2
Password input - Acceptable score of 3
Password input - Strong password score of 4

[tw4l]

Very nice! Tested and working great

[Shrinks99]

If we don't allow either level 1 or level 2, should we keep the error state the same between both levels?

... Or is there more value in showing users that their password has gotten more secure but still isn't enough? Currently leaning towards what we have already, but still worth a question.

[tw4l]

If we don't allow either level 1 or level 2, should we keep the error state the same between both levels?

... Or is there more value in showing users that their password has gotten more secure but still isn't enough? Currently leaning towards what we have already, but still worth a question.

I for one like the incremental changes as a way to know you're on the right track

[Shrinks99]

Minor changes, looks great! :D

[tw4l]

@SuaYoo I just realized we'll want to add this new password validation to the Account Settings password change flow and the reset a password from a "forgot password" email flow as well

[SuaYoo]

@SuaYoo I just realized we'll want to add this new password validation to the Account Settings password change flow and the reset a password from a "forgot password" email flow as well

Can you clarify what you mean? This is implemented in the account settings and reset password, see screenshots!

Edit: oh bummer, I see that my manual testing steps got truncated.

[tw4l]

This is implemented in the account settings and reset password, see screenshots!

Edit: oh bummer, I see that my manual testing steps got truncated.

Oh good, then never mind me! :)