[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Bug#725009: installer: Debian Installer gives wrong advice on choosing secure passwords



reassign 725009 partman-crypto
thanks

Quoting Andrei POPESCU (andreimpopescu@gmail.com):
> Control: reassign -1 debian-installer
> 
> On Lu, 30 sep 13, 14:52:17, Jacek Wielemborek wrote:
> > Package: installer
> > Severity: normal
> > 
> > Dear Maintainer,
> > 
> > I noticed that the "choose password" dialog that can be seen when 
> > asked for a LUKS password in Debian Installer gives wrong 
> > advice on how a secure password looks like. It says that a good 
> > password contains both uppercase and lowercase characters and 
> > punctuation, which might mislead users that are unaware that 
> > 16-character password that is an impossible-to-remember mixture
> > of characters is actually less secure than 20-characters-long 
> > password made of 4 English words, because the latter won't be
> > so easily forgotten (and isn't that much easier to crack). Please
> > change the text to educate the users properly on how to select
> > passphrases (passphrases, not passwords).


The original bug report mentioned "LUKS password" which means the bug
report doesn't belong to user-setup but partman-crypto and is about
choosing the encryption passphrase.

A,nd, for what's is worth, I disagree with this bug report. People's
mileage may vary about what is good for a passphrase and what is
not. This is not the purpose of the installer to explain people how
secure pass{words|phrases} should be and how they should be to be
secure.

The point of the  given details is about telling people what they can
do and what they can't.

So, I, for myself, veto any change to this debconf template.


Attachment: signature.asc
Description: Digital signature


Reply to: