Community registration password bug: strong password "too obvious"

matp

Tried to register to post on another bug type issue and discovered that my long auto-generated passwords were strong but too obvious to allow registration to continue.

Tried a lot of different ones before I got one that passed the filter. Definitely seems like there is some logic that could be improved in the "is the password obvious" check.

I am guessing because I just put in my last initial that it was rejecting passwords containing that single letter? Therefore the longer the password (more secure) the higher the probability that the password would contain my last initial and not pass?

Anyway, probably more of a UX issue than a normal bug and no doubt with the forum software and not specific to openvpn. Just found it interesting.

18 chars, numbers, upper, lowercase

26 chars, numbers, upper, lowercase, special chars

[deleted]

Hi,

Thanks for the detailed report - I will look into the password policy in the webapp. Just one question: does the above password contain your username?

matp

Password definitely doesn't contain username. I am guessing the issue was using a single initial for my last name. E.g. Matt "P" causes problems for any passwords with a single P character in them. Logically it makes sense to exclude names from being used in password...but only within certain parameters (e.g. password isn't already good or strong and/or name length being checked is significant percentage of password length). I could be wrong about what caused this, just guessing.