3

I just created a new user in CentOS 5.6 and run passwd user, providing the password io.6,{9001JIAIua121698aa]]. System says "BAD PASSWORD: it is too simplistic/systematic". Not a big deal (and it does accept it anyway), but I am really interested, how is this too simplistic/systematic?

  • My guess would be a check for repeated characters (00 aa ]]) that doesn't care how long the non-repeating parts of the password are. – DerfK Aug 14 '11 at 1:46
9

I could only see a Apple open source implementation, and it seems your password qualify as "too simplistic" in this case. The algorithms are likely to be similar.

The code is

    #define MAXSTEP   4

    i = 0;
    ptr = password;
    while (ptr[0] && ptr[1])
    {
        if ((ptr[1] == (ptr[0] + 1)) || (ptr[1] == (ptr[0] - 1)))
        {
            i++;
        }
        ptr++;
    }

    if (i > MAXSTEP)
    {
        return ("it is too simplistic/systematic");
    }

Basically it takes all characters from the password, and checks if the next character is the current character +/- 1 (characters being one byte).

In the password you provided

  io.6,{9001JIAIua121698aa]]

01, JI, 12, 21 and 98 increment the i counter. MAXSTEP being 4, the it is too simplistic/systematic message is triggered.

The algorithm is not very smart, as it does not take into account the length of the password, and the complexity of the other characters.