password is too complex for younger people

[Peter Sereinigg]

please add a possibility to define, how a password should look like. For younger people this complex password, you force here, is to difficult for use!

[Chris Walsh (fitzwalsh)]

Yes - we need to have flexibility to define our own password needs. Also - Mahara's default password requirements are different than Moodle's, so even with SSO working, Mahara asks the user to create a unique/longer password on first login. This is very awkward.

[Nigel-catalyst (nigel-catalyst)]

Do you happen to know Moodle's requirement, off the top of your head?

Not sure of the easiest way to fix this, as the password validation is a great big regex provided by an API method, and in theory admins might want to choose whether users had to use weaker/stronger passwords. I'm sure it's not that much work though.

[Nigel-catalyst (nigel-catalyst)]

This is worth fixing, I'd be tempted to reduce it to 5 characters, 0 numbers for now.

[François Marier (fmarier)]

I agree with Nigel and others on this. Let's stop pretending that password policies make people use good passwords.

[Melissa Draper (melissa)]

http://xkcd.com/936/ :D

In all seriousness, Mahara could help change/improve habits by suggesting what Randall describes. I propose that we don't merely reduce the minimum length and drop numbers requirements. I suggest that when we change the policy, we also offer alternative password guidelines in text alongside the password change fields.

[François Marier (fmarier)]

I like these suggestions, but let's create a different bug for them.

This one is about removing the pointless restrictions.

[Melissa Draper (melissa)]

http://xkcd.com/936/ :D

In all seriousness, Mahara could help change/improve habits by suggesting what Randall describes. I propose that we don't merely reduce the minimum length and drop numbers requirements. I suggest that when we change the policy, we also offer alternative password guidelines in text alongside the password change fields.

[Melissa Draper (melissa)]

https://reviews.mahara.org/#change,655

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/655
Committed: http://gitorious.org/mahara/mahara/commit/466c7763c4817b2b51fe3356aee09b06f8035848
Submitter: Francois Marier (<email address hidden>)
Branch: master

commit 466c7763c4817b2b51fe3356aee09b06f8035848
Author: Melissa Draper <email address hidden>
Date: Thu Sep 8 17:10:16 2011 +1200

    Change password restrictions for young users (bug #547469)

    As demonstrated by http://xkcd.com/936/ the current password policy encourages
    passwords with low entropy. Young users especially struggle with the password
    policy. This patch drops the mandatory number & 2 letters rule.

    Change-Id: Ifb9f4a24f53ab86ddf52f69ca3e07611c41bec64
    Signed-off-by: Melissa Draper <email address hidden>

[Melissa Draper (melissa)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

status: fixreleased
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJPjqbSAAoJECXBtiziiXdc9lQH/ihyu7QAsQTauz6R0kgBF2og
xGfwoCzflrqvhr0M52SR9mS/oVvb0ZerWl6CL2aJ8Aq5dTGNZ2+dHsDZTTYGQzF0
qLheaMcgjVQyCasJQzFwP4eVhxP5d7PUvHTPoB2SfQOMrzb6LdbF3ZuaPk11bImk
zjRhyzLIDuqPGCvkm/RSr3RlyuLlQD6/mSXfHLXRMKuG6ZXZQdgwvAgbRVrqCukJ
HeAfb9i1gVLgMoKO1OGur+sCYD155g6GtykNolwC1vXGI2lwL5yko4rBq47m1zTJ
iEMJngvutbkLqfkLye2DrqEGfPdJSD28cn0yTrGo4r8c8v+VErQG2fw28Do62AQ=
=PEOy
-----END PGP SIGNATURE-----

[Melissa Draper (melissa)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 status fixreleased
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJPjrRzAAoJECXBtiziiXdcggYH/39bWTAPjHe9fUi3ve11K6iW
/R7j+mSc51e/47Cx0Z1Xv1HkDY0ymFLyRU/4CgErzWLWtrlSVhDx/r3gf8aHj+A+
ICmHRmTTCRBij5sKZVZbzZDN/t9drPvJ1u1dWcagGR2DiXoxAa9Kd2LUXKScRvS6
DqhQWj42JiOoo1R1FGFLa8dpPwlzwuLKyQQ6gvdDutva0E3RqktUUBy8w6ieMG6E
UM/K4sdgx7AAhfBxg91349DOjKeHE/69Vb1gbJXE9UtY/xwe+3sgBtAM7aN4e5US
PhBcGckRLkgxpwLwDzTNGuDHFp51OjIdqXaoRAxXx3tgOonY2bs/eqg42RJBcR4=
=dLjM
-----END PGP SIGNATURE-----