77535 - scan dictionary for poor passwords

Status: RESOLVED WONTFIX

(Core Graveyard :: Security: UI, enhancement, P3)

Description

[Bob Lord]

When you are changing your password, the client should be able to do things
along the lines of:
-see if the user name is in the new password
-see if the password is in the localized dictionary
-see if the password matches some rules based the above items (e.g. user name
spelled backwards)

Questions:
-Should you be able to override the objections of the client if you choose a
weak password?
-Where is the threshold for quality? How complicated should the client make the
password?  There is a tradeoff here.

Comment 1

[Ben Bucksch (:BenB)]

> -Should you be able to override the objections of the client if you choose a
> weak password?

Yes.

Comment 2

[John Unruh]

Enhancment

Comment 3

[John Unruh]

Mass assigning QA to ckritzer.

Comment 4

[John Unruh]

OS > all

Comment 5

[Nelson Bolyard (seldom reads bugmail)]

Mass reassign ddrinan's PSM bugs (with his permission) to nobody

Comment 6

[Jesse Ruderman]

Firefox has a dictionary available on all platforms now :)