Increase $wgMinimalPasswordLength to 6 bytes
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	• csteipp
	Apr 10 2015, 11:43 PM

Description

https://www.mediawiki.org/wiki/Requests_for_comment/Passwords was accepted by the Architecture Committee, as discussed in https://www.mediawiki.org/wiki/Architecture_meetings/RFC_review_2014-03-05.

It was decided that $wgMinimalPasswordLength would be set to 6 bytes by default, pending a few tasks:

AGREED: increase $wgMinimalPasswordLength to 6 on WMF, and do the patch to login to allow old short passwords
ACTION: csteipp go ahead and implement the increase in minimum bytelength (sumanah, 21:19:37)
ACTION: csteipp turn the user group-level requirements into a new RFC https://www.mediawiki.org/wiki/Talk:Requests_for_comment/Passwords#Create_new_password_requirements_for_accounts_with_advanced_user_rights https://bugzilla.wikimedia.org/show_bug.cgi?id=44788 (sumanah, 21:20:04)
ACTION: csteipp coordinate with the community liaisons, Legal & Community Advocacy, et alia to communicate out about this change before flipping the switch (sumanah, 21:20:45)

Related Objects

Mentioned Here: T94774: Password policies by group

Event Timeline

• csteipp created this task.Apr 10 2015, 11:43 PM

• csteipp raised the priority of this task from to Needs Triage.

• csteipp updated the task description. (Show Details)

• csteipp added a project: TechCom-RFC.

• csteipp subscribed.

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptApr 10 2015, 11:43 PM

yuvipanda awarded a token.Apr 10 2015, 11:44 PM

Patch to allow login with old, short passwords: https://gerrit.wikimedia.org/r/#/c/117635/

Liuxinyu970226 awarded a token.Apr 12 2015, 1:49 AM

Liuxinyu970226 subscribed.

I'm guessing that this should also be in the Security project so I'll boldly add it.

Pine added a project: Security-General.Apr 16 2015, 7:44 AM

Pine set Security to None.

daniel moved this task from P1: Define to Under discussion on the TechCom-RFC board.Apr 22 2015, 8:32 PM

@csteipp Has this been implemented? TechCom Isn't sure. If so, you can just close this task.

• Spage moved this task from Under discussion to Approved on the TechCom-RFC board.Jun 17 2015, 8:31 PM

@Spage, No, not yet. Since we now (as of this week) have group specific passwords, I wasn't sure if that should change what we set for all users. Since 6 was chosen as a balance between being long for regular users and short for admins.

Nemo_bis added a project: Wikimedia-Site-requests.Nov 26 2015, 3:12 PM

Restricted Application added subscribers: StudiesWorld, Matanya. · View Herald TranscriptNov 26 2015, 3:12 PM

• RobLa-WMF edited projects, added TechCom-RFC (TechCom-RFC-Closed); removed TechCom-RFC.May 18 2016, 1:07 AM

Restricted Application added a subscriber: JEumerus. · View Herald TranscriptMay 18 2016, 1:07 AM

Danny_B added a project: Proposal.May 22 2016, 11:25 PM