TYPO3 Core

It would make sense to introduce some other checks as well, an integration with cracklib could be done, too. I think the core should provide maybe just checking if user/pass are identical, and everything else should be provided by an extension - so a hook might be needed there, if we can't use process_datamap-hooks.

The password check can be done at login time as you simply throw the login into the password-hashing function. If it's identical to the current password hash, then login and password are identical.

Using cracklib, etc makes only sense at the time you set the password. This is alos fine, but covers something different. This is about a warning that works like mentioned security warnings, ie at logon time.

If you want password checking at password change time please file a new bug.

The attached patch implements the wanted behavior. Please test if it works.
What do others think, should this become part of the core?

should this become part of the core?

yes please!

Although the issue is clear and the fix not so difficult, I'm not sure I agree to the general policy of issuing warnings for trivial passwords. What about warnings if the password is qwertz or 12345, etc.? Is it really our issue to educate users about choosing the right password?
I'd clearly vote for a hook-only solution...

a hook could be an additional nice to have feature, but I think we should at least urge the users to change their password to something different then the default or the password == username case

Adding more and more checks should be avoided. If we have too many wanrings, people tend to ignore them. And having weak passwords is something that probably should be "educated away" from the users in a different way.

The existing checks deal with default passwords that are shipped with TYPO3, any self-chosen, weak password isn't. So this is not our business, strictly spoken.

For those cases a hook to integrate e.g. cracklib is better.

I agree with Karsten. Avoid adding more and more "security checks" but write a hook instead.

I'll look into adding a hook, as it seems we agree on this being the best way to do this.

Should be fixed before 4.0 I think...

We already have a check for the default user admin with defazult password integrated in the about module and the reports module I think.

But what we could add would be a nice bar which changes its color from red over yellow to green when entering the password.