Password Validation Algorithm "Very Strong" ranking setting the bar too low

[mcfarlandonline]

PHP 7.3
EE 6.2.4

I recently tested out using the password validation script from the docs alongside a front-end member registration form. It seems pretty easy to get going, but upon testing, it's clearly not very strict.

For this site, I have the Password Security Policy set to "Strong"...

My passwords are getting validated as it relates to the minimum number of characters, but sequences and consecutive numbers aren't negatively impacting things as much as I expected. It appears that only one capitalized letter or special character is required to earn a "Very Strong" ranking. To further test things, I tried changing my Super Admin password in my profile. This seems a little overly forgiving...

Here's where we draw the line...

I wonder if we should just do away with a "Very Strong" ranking at this point, if the algorithm could be tightened up, or if there's a way to exclude certain words and strings (similar to the Word Censoring feature), while still allowing most dictionary words.

[intoeetive]

@mcfarlandonline you're aware about Allow dictionary words in passwords? setting, right?

[mcfarlandonline]

Hi @intoeetive,
We tried installing that, too, but don't see that it's making any difference. I've tried a bunch of combinations with:

• Allowing and disallowing dictionary words
• removing "password" from the dictionary.txt file
• Using capitals and lowercase versions

It doesn't appear that this setting is having any effect on our end. We also checked the wizard just in case a module on our server might be missing, but that looks good, too...

[intoeetive]

I think I know why you are experiencing this. Using the dictionary file is only performing "full match" check.
It does probably make sense to check for partial match.
We'll discuss this internally and maybe we might have some better solution indeed,
Thank you for reporting!