Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I was changing my password on Ubuntu 14.04 and wondering why is this password not good enough:

pr#cur@rempr_3go!

enter image description here

My current password is procurar@empr3go!

Any ideas?

share|improve this question
6  
i.stack.imgur.com/AhtKZ.png - it works for me... Very odd! –  Tim Jul 5 at 19:04
3  
I can't duplicate this. When I typed the exact password it says strong –  ElefantPhace Jul 5 at 19:05
15  
@vrcca: Just for the sake of security, you should never ever post your passwords anywhere. –  CijcoSistems Jul 5 at 19:52
8  
In addition to what @CijcoSistems said, change your password again and DON'T POST IT. It doesn't matter how secure it is if you tell everyone... –  Wilf Jul 5 at 21:34
3  
Thank you, but i don't use that password anywhere. That was just a test! :) Btw, I just changed it hehe –  vrcca Jul 5 at 21:46

2 Answers 2

up vote 40 down vote accepted

I think this answers my question: A strong password is significantly different from your previous password.:

Strong Passwords

Applications, and libraries exist for your Ubuntu system to assist in generating, or enforcing strong passwords. A strong password is defined as any password which meets the following criteria:

  1. At least fifteen (15) characters in length.
  2. Does not contain your user name, real name, organization name, family member's names or names of your pets.
  3. Does not contain your birth date.
  4. Does not contain a complete dictionary word.
  5. Is significantly different from your previous password.

  6. Should contain three (3) of the following character types. Lowercase Alphabetical (a, b, c, etc.) Uppercase Alphabetical (A, B, C, etc.) Numerics (0, 1, 2, etc.) Special Characters (@, %, !, etc.)

Since my current password and the new password ends with 3go!, Ubuntu won't let me reuse it.

Thank you all!

share|improve this answer
5  
excellent! upvote and accept as soon as you can. On AU it is custom to add important parts to the answer (as links tend to disappear). so I added a little bit from the wiki ;) –  Rinzwind Jul 5 at 19:41
7  
If passwords are hashed/salted, how could this be compared? –  WChargin Jul 6 at 22:07
4  
@Wchargin Did you notice the place in that dialog where it says "current password: ***********" ? –  Shadur Jul 7 at 7:21
1  
I don't think the problem is merely that both passwords ends with "3go!". Ubuntu would probably accept "Correct Horse Battery Staple 3go!" with no warning. The problem is that one can optain the new password from the old by making few changes. Your new password only needs 4 changes; o to #, remove @, a to @, remove _. –  Taemyr Jul 7 at 9:13
3  
@Shadur Ah—so it compares the new password to the password you entered as current, and verifies that the current password is correct (a = b; b = ca = c). That makes sense. Thanks! –  WChargin Jul 7 at 17:40

The reason it is not allowed is because you have enabled (somewhere - during installation?) to make you change every 72 days. This also disallows you from using the last password (and maybe ones before it, but it may only be the previous ones (See this comment).

Workaround:

This is clearly a strong password (or it was before you posted it), unless it had been used for another user or before for that user. I would suggest you add the user via terminal, as that doesn't have secure password requirements (but use one that isn't out there for the world to see, and please change your password soon, everyone knows it now). We can guess what your username is on your pc, probably the same as all your social networking accounts, and then your IP address can theoretically be traced through twitter of Facebook etc. NB: I'm not a hacker and I might be able to break in (I won't try), so a hacker would find it easily.

To change with terminal.

sudo adduser <username>

passwd <username>

Thanks Wilf for the comment about having posted it.

share|improve this answer
    
I haven't enabled password expiration, but thanks! –  vrcca Jul 5 at 20:17
11  
'This is clearly a strong password' - not if you write it down and post it online... –  Wilf Jul 5 at 21:35
    
...so you did just post your live password you use everywhere, just with like one character changed or something. An attacker could have instantly recognized why your password was rejected while you were still hoping someone would figure it out and generously post it. –  AAA Jul 7 at 6:01
    
Does this also mean that my past passwords are stored in plaintext somewhere? –  Amarghosh Jul 27 at 5:28
    
Not unless you use a 3rd party app that does. –  Tim Jul 27 at 7:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.