It asks me for 9 characters worth of password as minimum. I think it's a good recommendation to introduce good passwords, but I don't think we can require everyone to use such long passwords. Reproducible: Always
Sounds like a bad idea indeed, it should be to the users discretion to choose the password length. After all they are responsible for their own security.
https://fedorahosted.org/libpwquality/ one would think libraries are used by design and not by accident ;)
So it shouldn't?
Maybe. pwquality is configurable via /etc/security/pwquality.conf though, so at the end this is probably nothing more than a distro level policy decision. alas, I suppose the default length requirement being that high doesn't help either.
Should we close this as downstream and report it somewhere in Kubuntu then?
Maybe :P TLDR: design input needed on either 'should user-manager prevent the user from setting a weak password' or 'should user-manager only display a warning when trying to set a weak password but allow setting it all the same'. I doubt it's going to be changed in debian/ubuntu for no better reason than longer passwords being better and pwquality being used by the gnome and unity counterparts with the existing settings and no one claimed about those. IMO this needs some design input first regardless though. Either we want user-manager to be very secure or very convenient. The decision that you can not set a weak password is very much one made in user-manager. All pwquality does is evaluate whether a password is meeting the configured quality criteria; user-manager is the one preventing you from using a crappy password. (personally I'd favor informing the user about the weakness and letting them use it anyway)
I agree this would be a good compromise.
I'm able to set the worst of passwords so there is no required minimum length (only a recommended one). Can we close this report?
Well, I can't reproduce it. And looking at the code it certainly doesn't seem to enforce the quality anymore (even when pwquality says it should enforce it, which technically I guess is another bug ;))
As it turns out pwquality does in fact default to enforcement on, so honoring enforcement would in fact bring back this bug. So let's ignore this technicality and leave things as they are.