Steven Walling wrote:
I fully agree, and this is why the RFC is very clear
that the *only
immediate change proposed* is an increase in required minimum length from
one character to six. It does not suggest that we require more complex
character types, such as mixed upper/lower case, numbers, symbols and so
on. Just increasing the length, and hopefully suggesting to users how to
pick a strong password, is plenty for MediaWiki defaults.
General consensus (on this mailing list and at the RFC) seems to be that
we can certainly encourage stronger passwords, but we should not require
stronger passwords for standard accounts. Accounts with escalated
privileges (admin, checkuser, etc.) should likely be treated differently.
Ultimately, account security is a user's prerogative. If a user wants to
use "wiki" as his or her password, we can say that's not a great idea, but
I don't see why we would outright ban it. Similarly, more complex
passwords lead to people using a sticky note or similarly poor practices.
Wikimedia wiki accounts are nearly valueless. Banks and even e-mail
providers have reason to implement stricter authentication requirements.
Meanwhile on Wikimedia wikis, there's very little incentive to log in.
What's the purpose of securing such standard accounts? This has an
associated cost. What's the benefit?
Perhaps there are better arguments for why we should lock an unknown
number of users out of their accounts every time someone upgrades
MediaWiki, but currently the pros column seems a lot weaker than the cons
column for implementing this change to $wgMinimalPasswordLength.
MZMcBride