New password is weak message on creating users

[chopin70]

Hi,

Since more than a year, I notices this message when ever I create a new user or save changes to an existing user:

The attached images are broken !

Text of message is: 

The new password is weak, and will reduce the security of your system.
Recommended passwords contain at least 8 characters, one uppercase,
one lowercase, one number, and one special character.

Do you want to apply it anyway?

I was living with it, but now I am wondering why ?

I tried all password combinations respecting the rules in message and trying different special chars, but it always shows

Is it a bug ?

[chopin70]

Edited my post with the image attached as the forum seems broken with embedded images

[StephenB]

---

@chopin70 wrote:

Hi,

The new password is weak, and will reduce the security of your system.
Recommended passwords contain at least 8 characters, one uppercase,
one lowercase, one number, and one special character.

Do you want to apply it anyway?

I tried all password combinations respecting the rules in message and trying different special chars, but it always shows

Is it a bug ?

---

Qwe#1234 doesn't trigger the message on my system (running 6.10.3).  I substituted a couple of other special characters for the #, and didn't see the message either.

If you post a sample password that fails on your system, I can check it on mine.

[chopin70]

In fact, yours is fine

here's one that fails:

f587dTr-xfT

I think that any special character like -, *... will cause the message

However, if I login as user :

su - user_name

the password with all the special chars is accepted. So it was properly saved

Seems like a bug in the GUI when accepting passwords with some characters

[StephenB]

---

@chopin70 wrote:

here's one that fails:

f587dTr-xfT

I think that any special character like -, *... will cause the message

---

It fails on my system too. f587dTr^xfT is accepted though.

It looks like they are excluding some special characters - it'd be nice if @JohnCM_S or @Marc_V could tell us which ones.

---

@chopin70 wrote:

So it was properly saved

---

Yes.  It's a warning, and it will accept passwords that fail its strength check.

[chopin70]

For me it is a GUI bug because the message is misleading saying that the pass length or strength is not good while it is not the case + it accepts the whole password afterward

A variety of chars seem to cause it even undrescores, *...

thank you

[StephenB]

---

@chopin70 wrote:

For me it is a GUI bug

---

I agree.  It is triggering when it shouldn't.

Though I think the message wording already makes it clear that it will accept the password anyway if you proceed.