On Sat, 2012-05-19 at 18:26 -0400, Matthias Clasen wrote:
Hi,
I've spent an hour today making gnome-control-center use libpwquality
for its password quality checking:
https://bugzilla.gnome.org/show_bug.cgi?id=676396
It worked fine in general, just a few observations:
- the library would be a little easier to integrate if it installed a
pc file (see the attached patch)
OK, I'll include it in the next release. Thank you for the patch.
- I've never managed to see any of the pwquality messages,
because the
cracklib check always triggers first and gives a 'The password fails
the dictionary check'
I can switch the order of the checks - doing first the internal
libpwquality checks and the cracklib checks later.
- It would be nice to give some guidance how the range [0-100] is to
be interpreted - is everything below 30 considered weak ? everything
about 50 strong ? That would help ensuring uniform representation of
the quality
I'll try to document the scoring somehow - basically anything that does
not fail the checks can be considered as moderate password - especially
for purposes where fast brute force attacks are not possible. Anything
above 50 can be considered strong enough to sustain also brute force
attacks.
--
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb