Assuming that no one else has physical access to my computer, assuming that I don't run any unusual services, do I still need a strong password for my Ubuntu user account (it has admin privileges)?

I've heard that any Ubuntu system connected to the Internet needs a strong password because it may somehow affect not only this particular system, but even other machines with Internet access as well (for example, it would be easier to install spambots on a machine with a weak password). Is this true? How exactly does this happen? Do I also need strong passwords on my VirtualBox test systems?

Thank you

  • You don't - see here on how to change it: askubuntu.com/questions/113682/…
    – Takkat
    Sep 4 '13 at 6:09
  • @Takkat You might want to expand that into an answer; I'm not sure what other kind of answer could be given. Sep 4 '13 at 6:17
  • I don't know why is everyone asking "Why I need (strong) password". Stop that. Strong password is illogical 6+ character string with at least 1 number and 1 special character.
    – user45853
    Sep 4 '13 at 6:25
  • @ZDroid I'm not sure what you mean by that, or why you're telling people to stop asking questions about this, but these days with fast processing (including GPUs and cloud computing), it's quite easy to crack even a properly salted hash or bcrypt of any 6 character password, and under worst-cast scenarios brute-forcing over a network might even be successful for some passwords meeting your description. Sep 4 '13 at 6:32
  • 1
    @ZDroid By definition, brute forcing is always the simplest possible way to discover passwords (not necessarily the most efficient, though!). Do you mean it's hard? There's software that makes it quite easy. Sep 4 '13 at 6:37

The reasons to have a strong password are multiple. You can use Google in this sense. I will only note that:

  • Choosing a good password will help to keep your computer safe. If your password is easy to guess, someone may figure it out and gain access to your personal information.
  • People could even use computers to systematically try to guess your password, so even one that would be difficult for a human to guess might be extremely easy for a computer program to crack.

Even so, Ubuntu does not force you to use a strong password. By default, Ubuntu requires a minimum password length of 6 characters, but, assuming that no one else has physical access to your computer and assuming that you don't run any unusual services, you can turn off all the password prompts or you can enable auto-login or you can set a short password on Ubuntu.

Regarding the second question, I can say that I find it aberrant. So no, you didn't heard well.

  • I admit that I didn't form the second question properly. See this thread (posts 5-8) ubuntuforums.org/…. It says that the risk of something like, for example, spambots running on a user's OS may be increased if a weak password is used.
    – Dexter
    Sep 4 '13 at 9:33
  • @Dexter ...a spambot could easily be running on a system with a perfectly strong password, still affecting others on the internet. So it is not about how strong is the password. Sep 4 '13 at 9:51

Not the answer you're looking for? Browse other questions tagged or ask your own question.