How is “io.6,{9001JIAIua121698aa]]” too simplistic/systematic? [closed]

Question

I just created a new user in CentOS 5.6 and run passwd user, providing the password io.6,{9001JIAIua121698aa]]. System says "BAD PASSWORD: it is too simplistic/systematic". Not a big deal (and it does accept it anyway), but I am really interested, how is this too simplistic/systematic?

Answer 1

I could only see a Apple open source implementation, and it seems your password qualify as "too simplistic" in this case. The algorithms are likely to be similar.

The code is

    #define MAXSTEP   4

    i = 0;
    ptr = password;
    while (ptr[0] && ptr[1])
    {
        if ((ptr[1] == (ptr[0] + 1)) || (ptr[1] == (ptr[0] - 1)))
        {
            i++;
        }
        ptr++;
    }

    if (i > MAXSTEP)
    {
        return ("it is too simplistic/systematic");
    }

Basically it takes all characters from the password, and checks if the next character is the current character +/- 1 (characters being one byte).

In the password you provided

  io.6,{9001JIAIua121698aa]]

01, JI, 12, 21 and 98 increment the i counter. MAXSTEP being 4, the it is too simplistic/systematic message is triggered.

The algorithm is not very smart, as it does not take into account the length of the password, and the complexity of the other characters.