Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add ability to set weak password #9291

Open
RoboBurned opened this issue May 6, 2020 · 2 comments
Open

Add ability to set weak password #9291

RoboBurned opened this issue May 6, 2020 · 2 comments

Comments

@RoboBurned
Copy link

 * Cinnamon version: Cinnamon 4.4.8
 * Distribution - Mint 19.3
 * VirtualBox
 * 64 bit

Issue
During installation of Mint 19.3 user is free in choosing his password. It can set it to any value even "1". After installation I want to to change it to "123". Both "Account Details" and "Users and Groups" dialogs do not allow to change the password to "123" because it is too short.

I use VirtualBox to play with different Linux distibutives and I don't care about security at this point. I want to all my VMs have the same password. There are may be many reasons why user have to use short password. We should not limit it here.

Steps to reproduce
Install Linux Mint. During installation set any short password.
Log into the system and try to change password to any value shorter than 8 chrs by using either "Account Details" or "Users and Groups" dialog.
"Change" button is disabled.

Expected behavior
User is able to set any password. A warning text is displayed informing about password weakness.

Other information
Another more complex solution could be defining a password policy configured by administrator. I don't need this.

@PlazmaKG
Copy link

PlazmaKG commented May 11, 2020

I imagine that this is a security thing. Having a password that short, and only numbers, breaks the purpose of a password in the first place, since that could be vert easily guessed, through brute force methods. For example, if you somehow get a piece of malware on your machine (I know Linux has less malware made for it but it still exists). With a password that short, that virus would be able to easily find a short password within less than a second most likely, and gain root privileges into your operating system. The security of Linux isn't there if you don't have at least a somewhat strong password. It's important this protection is there to prevent novice users from making weak passwords. Even if the system tells them it's weak, novice users tend to not understand, or care about it, which is where letting it happen becomes an issue.

If you're using a VM to goof with Linux Mint, why not just use the terminal to change your password after install? In the terminal do "sudo passwd (username)" then for the new password type 123, and that'll change it to a short password.

@RoboBurned
Copy link
Author

@PlazmaKG I agree that short password can easily be break. All users should think of their security. I just don't like the method we try to enforce this.
For regular home user who is not a professional in Linux current approach does not allow user to change less secure password "1" to a more secure password "zx_@#C5" phrase and will use the one set during installation. This does not bring security.
For professional user this is not an issue, he can use sudo passwd to change it to any value, but I think UI and all "Settings" applets were developed to make it easier to change settings without using command line. Forcing such users use command line does not bring security as well.
We cannot require user to be security expect. We just should guide him, suggest better practices and warm about potentially risky situations without limiting him in reaching his goals.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants