Groups > linux.debian.bugs.dist > #1189203

Bug#1064617: Passwords should not be changed frequently

From	Philip Hands <phil@hands.com>
Newsgroups	linux.debian.bugs.dist, linux.debian.maint.boot
Subject	Bug#1064617: Passwords should not be changed frequently
Date	2024-03-05 22:30 +0100
Message-ID	<IeKwh-eF8w-1@gated-at.bofh.it> (permalink)
References	(8 earlier) <IeHRL-eDuh-1@gated-at.bofh.it> <IeINP-eE3x-1@gated-at.bofh.it> <IeJTz-eEGE-3@gated-at.bofh.it> <IbaSl-cqaY-3@gated-at.bofh.it> <IeJTz-eEGE-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Justin B Rye <justin.byam.rye@gmail.com> writes:

> Holger Wansing wrote:
>> @d-l10n-english: hey guys, we would like to get a proposal reviewed, 
>> which aims to improve the root/user password screens in the installer.
>> 
>> Please find the related merge request at
>> <https://salsa.debian.org/installer-team/user-setup/-/merge_requests/7>
>
> It needs a small amount of rephrasing, but the most important problem
> is that it starts by saying you need to set a password and then goes
> on to suggest that you might not need to set a password.  Maybe that
> can be fixed by rearranging things slightly...
>
>  Template: passwd/root-password
>  Type: password
>  # :sl1:
>  _Description: Root password/passphrase:
>   To allow direct password/passphrase-based access to the 'root'
>   (system administrative) account you can set it up here.
>   The results can be disastrous if a malicious or incompetent user
>   obtains root access, so you should not set one that can be guessed,
>   found in dictionaries, or easily associated with you.
>   .
>   Alternatively, you can lock root's password
>   by leaving this setting empty, and
>   instead use the system's initial user account
>   (which will be set up in the next step)
>   to become root. This will be enabled for you
>   by adding that user to the 'sudo' group.
>   .
>   Note: what you type here will be hidden (unless you select to show it).
>
> Does this still feel like the same advice?

The reason behind that structure was supposed to be that one definitely
needs _a_ password, but not necessarily a root password, so the password
advice applies to whichever password you'll decide to grant root access
to, which might not be set here.

I'm OK with the way you've phrased it, although my personal preference
would be to simply drop the "disastrous" sentence if we use this
version, because I think it breaks the straightforward flow of the text
laying out the choice we're trying to get the user to make between the
two available options. (I also rather doubt that anything we say at this
point in the install will have the slightest influence on people's
choice of password).

> Otherwise the only thing I see is:
>
>  Template: passwd/user-password
>  Type: password
>  # :sl1:
>  _Description: Choose a password/passphrase for the new user:
>   Make sure to select a strong password/passphrase, that cannot be guessed.
>
> No comma needed there.

Well done -- I kept noticing that, and somehow didn't get round to
fixing it. I've now deleted it, so thanks for pointing it out again. :-)

Cheers, Phil.
-- 
Philip Hands -- https://hands.com/~phil

Thread

Bug#1064617: Passwords should not be changed frequently Matthew Wilcox <willy@infradead.org> - 2024-02-25 01:50 +0100
  Bug#1064617: Passwords should not be changed frequently Pascal Hambourg <pascal@plouf.fr.eu.org> - 2024-02-25 23:50 +0100
    Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-02-29 21:10 +0100
      Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-02-29 23:20 +0100
        Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-01 00:40 +0100
          Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-01 07:00 +0100
            Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-01 15:50 +0100
            Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-01 21:00 +0100
              Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-01 22:40 +0100
                Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-02 21:10 +0100
                Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-02 23:00 +0100
                Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-03 00:50 +0100
                Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-04 06:30 +0100
                Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-04 10:50 +0100
                Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-04 16:10 +0100
                Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-04 22:40 +0100
                Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-04 23:00 +0100
                Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-04 22:10 +0100
  Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-05 16:20 +0100
    Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-05 18:00 +0100
      Bug#1064617: Passwords should not be changed frequently Cyril Brulebois <kibi@debian.org> - 2024-03-05 19:40 +0100
        Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-05 20:40 +0100
          Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-05 21:50 +0100
            Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-05 22:30 +0100
              Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-05 23:00 +0100
                Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-06 08:40 +0100
                Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-06 09:20 +0100
                Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-06 11:20 +0100
                Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-06 13:30 +0100
                Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-06 14:00 +0100
                Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-06 16:00 +0100
                Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-07 09:00 +0100
                Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-07 20:30 +0100
                Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-08 20:10 +0100
                Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-08 23:20 +0100
                Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-09 14:00 +0100
                Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-09 16:40 +0100
        Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-05 20:50 +0100
          Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-06 19:50 +0100
  Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-05 19:40 +0100

csiph-web