30

I was changing my password on Ubuntu 14.04 and wondering why is this password not good enough:

pr#cur@rempr_3go!

enter image description here

My current password is procurar@empr3go!

Any ideas?

13
  • 6
    i.stack.imgur.com/AhtKZ.png - it works for me... Very odd!
    – Tim
    Jul 5, 2014 at 19:04
  • 3
    I can't duplicate this. When I typed the exact password it says strong Jul 5, 2014 at 19:05
  • 16
    @vrcca: Just for the sake of security, you should never ever post your passwords anywhere. Jul 5, 2014 at 19:52
  • 9
    In addition to what @CijcoSistems said, change your password again and DON'T POST IT. It doesn't matter how secure it is if you tell everyone...
    – Wilf
    Jul 5, 2014 at 21:34
  • 4
    Thank you, but i don't use that password anywhere. That was just a test! :) Btw, I just changed it hehe
    – vrcca
    Jul 5, 2014 at 21:46

2 Answers 2

44

I think this answers my question: A strong password is significantly different from your previous password.:

Strong Passwords

Applications, and libraries exist for your Ubuntu system to assist in generating, or enforcing strong passwords. A strong password is defined as any password which meets the following criteria:

  1. At least fifteen (15) characters in length.
  2. Does not contain your user name, real name, organization name, family member's names or names of your pets.
  3. Does not contain your birth date.
  4. Does not contain a complete dictionary word.
  5. Is significantly different from your previous password.

  6. Should contain three (3) of the following character types. Lowercase Alphabetical (a, b, c, etc.) Uppercase Alphabetical (A, B, C, etc.) Numerics (0, 1, 2, etc.) Special Characters (@, %, !, etc.)

Since my current password and the new password ends with 3go!, Ubuntu won't let me reuse it.

Thank you all!

5
  • 5
    excellent! upvote and accept as soon as you can. On AU it is custom to add important parts to the answer (as links tend to disappear). so I added a little bit from the wiki ;)
    – Rinzwind
    Jul 5, 2014 at 19:41
  • 8
    If passwords are hashed/salted, how could this be compared?
    – wchargin
    Jul 6, 2014 at 22:07
  • 5
    @Wchargin Did you notice the place in that dialog where it says "current password: ***********" ? Jul 7, 2014 at 7:21
  • 2
    I don't think the problem is merely that both passwords ends with "3go!". Ubuntu would probably accept "Correct Horse Battery Staple 3go!" with no warning. The problem is that one can optain the new password from the old by making few changes. Your new password only needs 4 changes; o to #, remove @, a to @, remove _.
    – Taemyr
    Jul 7, 2014 at 9:13
  • 3
    @Shadur Ah—so it compares the new password to the password you entered as current, and verifies that the current password is correct (a = b; b = ca = c). That makes sense. Thanks!
    – wchargin
    Jul 7, 2014 at 17:40
14

The reason it is not allowed is because you have enabled (somewhere - during installation?) to make you change every 72 days. This also disallows you from using the last password (and maybe ones before it, but it may only be the previous ones (See this comment).

Workaround:

This is clearly a strong password (or it was before you posted it), unless it had been used for another user or before for that user. I would suggest you add the user via terminal, as that doesn't have secure password requirements (but use one that isn't out there for the world to see, and please change your password soon, everyone knows it now). We can guess what your username is on your pc, probably the same as all your social networking accounts, and then your IP address can theoretically be traced through twitter of Facebook etc. NB: I'm not a hacker and I might be able to break in (I won't try), so a hacker would find it easily.

To change with terminal.

sudo adduser <username>
passwd <username>

My pronouns are He / Him

6
  • I haven't enabled password expiration, but thanks!
    – vrcca
    Jul 5, 2014 at 20:17
  • 12
    'This is clearly a strong password' - not if you write it down and post it online...
    – Wilf
    Jul 5, 2014 at 21:35
  • ...so you did just post your live password you use everywhere, just with like one character changed or something. An attacker could have instantly recognized why your password was rejected while you were still hoping someone would figure it out and generously post it.
    – djechlin
    Jul 7, 2014 at 6:01
  • Does this also mean that my past passwords are stored in plaintext somewhere?
    – Amarghosh
    Jul 27, 2014 at 5:28
  • Not unless you use a 3rd party app that does.
    – Tim
    Jul 27, 2014 at 7:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .