Can't register me

[HKaufmann2]

If I enter my password, the registration field will remain greyed out.
My password is longer than 10 characters, has letters small/large , numbers and special characters.
If I only enclose 6 characters it works. Clearly too little
Wenn ich meine Passwort eingebe, bleibt das Registieren-Feld ausgegraut.
Mein Passwort ist länger als 10 Zeichen, hat Buchstaben klein/groß , Zahlen und Sonderzeichen.
Wenn ich nur 6 Zeichen eingebe klappt es. Eindeutig zu wenig

[lambdakilo]

Do you have a valid email selected to the registration field?

[HKaufmann2]

Yes. With a password with only 6 characters it works.

[lambdakilo]

That does indeed sound too little. Please open up an issue appended with any logs you can get when putting over 6 characters of password.

[HKaufmann2]

Which log file?

[lambdakilo]

Whichever throws out an error or a warning when you input more than 6 characters of password.

[HKaufmann2]

There is no error message and no warning, the registration field just cannot be selected.

[lambdakilo]

@tankerkiller125 Could this be regression? #695

[HKaufmann2]

Don't have a password manager. Working on Linux-Mint 22.3.

[lambdakilo]

Best of luck to your endeavors then.

[HKaufmann2]

I do not understand this answer?

[lambdakilo]

It means I can't help you so you shouldn't wait up on me. I, however, wish you luck so you may find a solution to your problem soon.

[HKaufmann2]

Thank you for your try.

[tonyaellie]

What strength is it showing the password as?

[tankerkiller125]

The goal is to shift the focus from complexity (special characters and randomness) to entropy (length and unpredictability). While a short, complex password looks intimidating to a human, it’s a breeze for a computer. A long passphrase creates a mathematical mountain that is significantly harder to climb.

The Problem: Complexity vs. Length

Modern password crackers don't "guess" like humans do; they use brute-force algorithms and massive "dictionary" lists.

• Short & Complex: A password like Tr0ub4dor&3 is hard for a human to remember, but because it is only 12 characters, the total number of possible combinations is relatively low.
• Short & Random: A password like D$90ASamo$1 is just as easy to crack as well because like the Short & Complex password, it's short, and thus the number of possible passwords fairly low.
• Passphrases: A phrase like correct-horse-battery-staple uses more characters. Even if the words are common, the length increases the "search space" exponentially.

---

Comparison: Time to Crack

Estimates vary based on the hardware used (e.g., a single PC vs. a cluster of high-end GPUs), but the scale of difference remains the same.

Password Type	Example	Length	Estimated Time to Crack
Random Mixed	qZ8#mN2	7	Instantly
Short "Strong"	P@ssw0rd1!	10	~2-3 weeks (Note, a dictionary based attack will solve this in seconds)
Simple Passphrase	blue-cloud-river-run	19	Centuries
Long Passphrase	I-love-to-eat-pizza-at-midnight	31	Millions of years

Note: These times assume an "offline" attack where a hacker has stolen a database of hashed passwords and is running a cracker locally.

---

Why Passphrases Win

1. Exponential Growth: Every character added increases the difficulty of cracking it exponentially, not linearly. Going from 8 to 16 characters doesn't make it twice as hard; it makes it trillions of times harder.
2. Human Memory: It is much easier for our brains to visualize a story or a string of words (e.g., the-green-cat-is-fast) than it is to memorize a random string of symbols (e.g., ^G7!kL9$).
3. Resistance to Brute Force: Most automated tools are optimized for shorter strings. Once you cross the 15-20 character threshold, the sheer number of permutations becomes computationally "expensive" for most attackers.

[HKaufmann2]

Unfortunately, your system does not.

[tankerkiller125]

Github was breaking when I sent that, and I made an edit, but apparently it didn't save said edit. I've not had a chance to dig into our own system yet, but most likely it has a dictionary that it also checks, and commonly used words reduce the entropy rating.

[tankerkiller125]

Update, the backend doesn't enforce any password requirements as far as I can tell it's all done on the frontend (at least the scoring part). And it's to say the least, very basic, likely something we'll want to revisit at some point.

To summarize it though:

• There are a list of "banned" words, insta 0 score: password, homebox, admin, qwerty, login
• Every letter increases the score, up to a repetition of 5 (doesn't matter the caps or not)
• Bonus score for upper, lowercase, digits and nonword characters.
• Variation also adjusts the score (more = better)

[HKaufmann2]

Since your system does not comply with all the specifications, how can I change my password afterwards. Don't find this feature.