WordPress site password update issue

[rahul286]

# ee site update wcmum.rtcamp.net --password
Provide WordPress user name [admin]: rtcamp.net
Provide password for rtcamp.net user: 
Password Unchanged. Hint : Your password must be 8 characters long

I think we should allow generating password less than 8 chars. WordPress allows using smaller password.

[MiteshShah]

@rahul286 I guess we should stick with minimum 8 character password policy.

As min 8 character password is industry standard, also EasyEngine is not only automate wordpress setup but also provide good security to its users.

[MiteshShah]

I dont think its a bug its security features for EE users which wordpress doesn't provide to its users.

I want even more complicated password like

the use of both upper- and lower-case letters (case sensitivity)
inclusion of one or more numerical digits
inclusion of special characters, e.g. @, #, $ etc.
prohibition of words found in a dictionary or the user's personal information
prohibition of passwords that match the format of calendar dates, license plate numbers, telephone numbers, or other common numbers
prohibition of use of company name or an abbreviation

But most of users are not good with that so we decided 8 character length min.

[rahul286]

IMHO our password requirement must match WordPress.

8 character long password alone won't give security. Bruteforce can be blocked by nginx rate limit module as well.

[rahul286]

My requirement is based on - http://en.wikipedia.org/wiki/Principle_of_least_astonishment

EE auto-generated passwords are already complicated enough. If a user is changing password manually, do not surprise him by adding validation that is not present in WordPress.

[MiteshShah]

@rahul286 Nginx rate limit is used for only when attacker used same ip address for brute force attack,

Nowadays we can combine tor and small script which change ip address every sec, when start brute force attack in that case nginx rate limit is not useful.

8 character long password alone won't give security

I know but its good to have something instead of nothing, if 8 character password is cracked easily means less then 8 character password will be cracked more easily

@gau1991 @harshadyeola What you think on this guys ?

[rahul286]

If a person has so much to lose, he will ensure his own security! In that case, he might go for 2-factor authentication and HTTP auth layer on wp-login.php.

There are so many ways to give better security. Why surprise users?

This will be removed from EE. It goes against EASY principle. I myself got a surprise when I wanted to change password to something simpler on a test site.

[MiteshShah]

@rahul286 Agree with you

But i think when we allow to choose less then 8 character password we must warn users by displaying some warning message

[rahul286]

Warning is fine.

[harshadyeola]

@rahul286
I agree with @MiteshShah, atleast we are developing user to keep secure password.
Also agree with @rahul286 Easy Principle.
I think we should display Warning for the user .