Strongbox: Audit Feature Issue with Empty Passwords

[shad0whawk]

Thanks for adding the audit feature. I find this very useful. I was testing it and found a possible issue. I have entries with no password populated. The first time I ran the audit feature it flagged those entries as “no password”. I turned off the empty password option and reran it. Now it flags the same entries as “duplicate passwords” because of multiple blank passwords. This seems like a false positive since I deselected the empty passwords option and it should ignore these in the duplicate check.

[mmcguill]

Thanks @shad0whawk - This is excellent, I was just about to comment on the Audit ticket looking for feedback... You're very fast. This does indeed sound like a bug. Cheers.

[Slummi]

I‘m also testing the new feature.
What does the similarity threshold exactly mean? I‘d expect that a value of 99 % will also find all duplicated passwords or is it reveresed and a lower value means more matches and a higher value less matches? But in that case a 99 % should find nearly all entries which are completely different?!

[mmcguill]

@Slummi - Yes lower value means less similar, 99% would be very very similar but identicals are excluded because they are picked up by a different check (duplicate check).

75% is the default, so this will pick up something like a 1 in 4 character difference, e.g. walk & wall would be found.

Similarity uses an Edit Distance algorithm (Levenshtein Distance)