In Ubuntu server 10.04 LTS, I typed passwd to change my password and accidentally typed the new password in response to the prompt for the current password. Instead of saying "incorrect password" or something equally reasonable, which would have caused me to smack my forehead and do it right the next time, I got the insane response "passwd: Authentication token manipulation error"! This caused me to go down a rathole for fifteen minutes, reading many pages with many possible reasons for this error, none of which were "you mistyped your original password".
This is a real user-interface FAIL and is certainly a regression in understandability. It's obviously been there for a while; 9.04 does this, although I note that Hoary 5.04 (yes, I still have a machine that old) says "passwd: Authentication failure" instead, which, while still not exactly user-friendly, at least puts "authentication" and "failure" -and nothing else- into the error to give people half a clue that maybe they mistyped something. (It's still not an error message users should see, compared to "incorrect password".) But the current error message is so obfuscated ("token manipulation error"---wtf is -that-?) that it's absolutely no help at all---either to a user trying to figure out what's going on, -or- to Google, considering how many other scenarios cause it to spit out that error message.
Yuck.
I don't think this is a problem with shadow - it looks like that error message is being given by pam. It makes a little more sense for pam_chauthtok to give that error.