installers (both ubiquity and d-i) allow single character passwords and encryption passphrases.

After completing my Kubuntu installation, I rebooted and logged in using my shiny new password 'a' and dropped to a shell. I tried changing my password via the passwd command, but the default policy there requires at least 6 chars, not 1 and also checks against a dictionary for simple passwords.

I also tried changing my password using the "Change Password" option in System Settings/Account Information and it too refused to allow me to set a single char password.

This is a BIG problem, IMO...

Tried one more thing and in the GUI it tells me that the password z1c3b5 is too simple... ??

Also, now confirmed that Ubiquity in both 64 and 32bit Kubuntu allow me to set single character passwords.

Now confirmed that this behaviour also exists in 64bit Ubuntu Desktop. Though at least there I get a red warning that it's a "Short Password" where ubiquity in Kubuntu doesn't say anything.

Now discovered that d-i allows me to set a single character passphrase for an encrypted lvm as well as also setting a single character password.

Wubi too... sigh... I supposed this is a design decision, but if so, IMO it's not necessarily a good one.

A: the policy is different between installer and running system
B: allowing single char passwords is just horribly insecure (though I must admit that with today's password/PIN filled world, guessing that a given user would have a single character password would be a stretch)

I realise the policy is slightly different, and ideally we'd run the password through PAM to see what it says, but unfortunately this isn't possible because the user doesn't exist yet when we're asking the question and so you can't ask PAM to set its password - we did look at this when implementing the "weak password" warnings in the installer and it wasn't feasible. Thus, the installer does its own checks.

In d-i, I have no problem with it being *possible* to force a weak passphrase in all the contexts you mention, although you should always get a warning dialog. Please confirm whether this was the case.

The other issues here seem to be:

 * Ubiquity's KDE frontend doesn't show password warnings
 * Wubi has no password checks
 * Perhaps some passwords should be rejected in Ubiquity rather than merely producing warnings

No assignee, and wishlist, taking off the alpha-3 radar.

That's not installer's damned business which kind of password I want. Close it now.

AsstZD,

This is hardly the place to post opinions. Please refer to the Ubuntu Code of Conduct before continuing.

This isn't release critical for natty.

okey i dont know how to use the command or anything with lenux/.... my lil brother changed my opertating system from Windows to lenux... what is the Owner password to my lenux, the administrator passkey.... everything i need help... if yiou guys can do something from your end... i used to be able to upload google talk.... cant.... please if you can program my laptop back to its default system.... help

Thank you for reporting this bug to Ubuntu. oneiric has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against oneiric is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.