Installer does not check if password is strong enough

[ShawnStarr]

Wishlist: It surprises me that the Debian installer does not check if the user's password is strong enough. Given you can sudo to root using this password (effectively) it might make sense to check if the user should make a stronger one? They can of course override the notice if they wish.

[ShawnStarr (shawn-starr)]

I should note, the installer only checks length, not strength of password.

[Colin Watson (cjwatson)]

FWIW the security team said they were OK with this for the time being; the problem is essentially that (a) very few utilities are available at the point when we need to check this, e.g. not things like cracklib, (b) in the graphical installer, UI constraints require that the password strength be checked on the fly so it needs to be quick. Thus we ended up with the current compromise.