Issue Strong password security policy isn't accepting strong password

[Beau Dilon]

According to the security policy page, a "Strong" password:

These passwords are at least 8 characters long and have at least one occurrence of upper and lower-case characters, digits, and special characters.

However, when trying to create an email account from the CLI, passwords which meet these requirements are being rejected. It seems it needs at least 2 special characters, specifically not just any special character, but one of !,@,#,$,%,^,&,*,?,_,~

This specific requirement should be noted. Here are some example passwords that have been rejected according to the policy:

ahwei.gh6Aih
aeH6doaGeth$
w!9>W9i,6
1]H__O_rW
uNj~4`IZ

 

[D3nnis3n]

Yeh, their algorithm is horribly broken:

Password security "secure" does not recognize a secure password as secure but as 'medium'

User name: D3nnis3n TITLE Password security "secure" does not recognize a secure password as secure but as 'medium' PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE Plesk Obsidian 18.0.30, Ubuntu 20.04.1 PROBLEM DESCRIPTION Kl1#-3zL (for example) is not recognized as a secure password but...

talk.plesk.com

 

[Bitpalast]

I wouldn't really call it horribly broken but rather very smart. The only issue it has is that it is not documented correctly. But the approach to dynamically adjust the minimum number of characters based on the variety of the string is some smart piece of software, not just an ordinary algorithm.

 

[mow]

I wouldn't really call it horribly broken but rather very smart. The only issue it has is that it is not documented correctly. But the approach to dynamically adjust the minimum number of characters based on the variety of the string is some smart piece of software, not just an ordinary algorithm.

I would call accepting 123$%&A (only 7 characters!) as "strong" horribly broken.

 

[msmallet]

Agree. A password of 7 characters is from the day before yesterday. I was just wondering why symbols like ~ or > are rejected? There must be a justification behind this, but I cannot figure out any.