Noticed when you set a password, the word "password" is considered "Fair". This patch treats the situation just like if you use your username, but fires if the password starts with "password".

CommentFileSizeAuthor
user-password-password.patch1.17 KBjon pugh

Comments

Status: Needs review » Needs work

The last submitted patch, user-password-password.patch, failed testing.

budda’s picture

budda
Primary language English
Location Cheshire
commented

Glad somebody else noticed this behaviour with the strength checker.

What might be better is a contrib module to check a new password against an online dictionary to stop users form using such silly words and being affected by a dictionary attack. But then you have the problem of multi lingual dictionaries to consider I suppose.

frob’s picture

frob
Primary language English
commented

This is big issue.

While another module that can check passwords would be good, I think that the built in password strength meeter should work.

devin carlson’s picture

devin carlson commented
Assigned: jon pugh » Unassigned
Priority: Minor » Normal
Status: Needs work » Closed (duplicate)

"password" is technically not a bad password as it is long enough to require a pretty big search space when trying a brute force attack so the password strength checker is working as designed (but obviously far from ideal).

Since there are so many common passwords (password, 123456, etc), the only way to fix the password strength checker would be to finish #340043: Warn against repeating character classes in passwords and either including pluggable + translatable dictionaries to check against or warn users that dictionary words aren't safe to use.

Since displaying a warning is a much easier solution, I'm marking this as a duplicate of #164994: False sense of security for password strength.