The minimum length of a password should be increased from 1 byte to 6 bytes.

Support Length increase to 6 bytes

1. But prefer 8 bits. Worm^TT(talk) 10:47, 5 November 2015 (UTC)
2. Yep. Callanecc (talk • contribs • logs) 11:19, 5 November 2015 (UTC)
3. Support. POV alert, but this fits my ideas of common sense. --Dweller (talk) 11:22, 5 November 2015 (UTC)
4. At least this, but preferably 8 bytes. The longer the minimum, the better the password entropy. epic genius (talk) 14:04, 5 November 2015 (UTC)
5. At a minimum. --kelapstick^(bainuu) 17:25, 5 November 2015 (UTC)
6. Sounds reasonable--Ymblanter (talk) 17:49, 5 November 2015 (UTC)
7. Second choice to 8 bytes. BethNaught (talk) 19:24, 5 November 2015 (UTC)
8. At the very least. Six is definitely too short, but I'm not sure about eight. — Earwig ^talk 09:03, 6 November 2015 (UTC)

   Would you compromise on seven? All the best: Rich Farmbrough, 14:03, 6 November 2015 (UTC).
   

   Eh, eight seems fine the more I think about it. — Earwig ^talk 15:39, 6 November 2015 (UTC)

9. At a minimum. It's not going to be sufficient if you reuse a password with a site that gets breached and uses an obsolete hashing algorithm (MD5, SHA-1) -- brute force gives you as little as two hours (SHA-1) against someone with one GeForce Titan X. MER-C 17:44, 6 November 2015 (UTC)
10. Minimum. JohnCD (talk) 22:18, 6 November 2015 (UTC)
11. Okay. Risker (talk) 05:48, 7 November 2015 (UTC)
12. 6 or 8 seem reasonable. Mkdw^talk 22:26, 7 November 2015 (UTC)
13. Per above Second choice after 8 bytes. ---- Patar knight - ^chat/_{contributions} 04:01, 20 November 2015 (UTC)
14. Minimum acceptable standard, but 8 bytes would be better. jni ^(delete)_{...just not interested} 18:29, 26 November 2015 (UTC)

Oppose Length increase to 6 bytes

1. Far too short. Even with 95 base characters upper/lower alphnumeric +33 others, that's less than 10^12 combinations. --RexxS (talk) 03:00, 7 November 2015 (UTC)
2. Too small. This gives anyone with a CUDA-based password guesser the ability to do offline cracking, giving them instant access to any Wikipedia account that used a minimum-length password. --Guy Macon (talk) 19:52, 20 November 2015 (UTC)
3. Creates a false sense of security. For the purpose of a dictionary attack, 1 character is as good as 6 or 8. --Pgallert (talk) 18:23, 26 November 2015 (UTC)

   Its somewhat debatable how useful this is. Certainly, a 6 character password, is not very secure (and certainly, its very useless if someone uses a common password). But in the event of an online attack, it might help against a not all that dedicated attacker, or at least make the attack stand out enough in the server log to be noticed. Bawolff (talk) 00:32, 1 December 2015 (UTC)

4. Not usefully better than the status quo. LFaraone 04:28, 30 November 2015 (UTC)

The minimum length of a password should be increased from 1 byte to 8 bytes.

Support Length increase to 8 bytes

1. For preference Worm^TT(talk) 10:47, 5 November 2015 (UTC)
2. Support While no password is truly uncrackable, the longer the password, the harder it is to crack KoshVorlon 11:46, 5 November 2015 (UTC)
3. Support. Basic security for almost any system I've ever used enforces a minimum length of at least 8. Amortias (T)(C) 12:29, 5 November 2015 (UTC)
4. As per my comments under "6-bits" [sic]. I think eight-byte-minimums are, at the very least, a little stronger password entropy. epic genius (talk) 14:04, 5 November 2015 (UTC)
5. The larger the solution space to test, the longer it would take for someone to try and break in. I consider 8 bytes to be the best compromise between users remembering and brute force attemp duration. Hasteur (talk) 15:58, 5 November 2015 (UTC)
6. Based on my totally unqualified guessing, it seems like the 7 to 8 is the watershed point, where it goes from relatively easy, to relatively difficult to crack. I would support this (without mandatory special character/number/capitals) for all editors, and encourage administrators to use more than 8. --kelapstick^(bainuu) 17:28, 5 November 2015 (UTC)
7. 8-10 chars is probably crackable from the hashes but this strikes a balance between memorisability and security. BethNaught (talk) 19:24, 5 November 2015 (UTC)
8. 8 bytes is too short to stop brute-force attempts on password dumps, while being too long to trivially memorize. It's a good compromise. --Carnildo (talk) 02:57, 6 November 2015 (UTC)
9. Pretty good requirement. APerson (talk!) 14:15, 6 November 2015 (UTC)
10. Looks like a basic and simple way to improve security. Rcsprinter¹²³ (sing) 14:32, 6 November 2015 (UTC)
11. This should be sufficient against someone with a bunch of GPUs even if someone uses the obsolete SHA-1. MER-C 17:50, 6 November 2015 (UTC)
12. Adequate. JohnCD (talk) 22:19, 6 November 2015 (UTC)
13. Okay. Risker (talk) 05:49, 7 November 2015 (UTC)
14. 6 or 8 seem reasonable. Mkdw^talk 22:26, 7 November 2015 (UTC)
15. yes, this is adequate and should not be a burden for any editor to make this amendment. Fylbecatulous talk 16:15, 8 November 2015 (UTC)
16. Unless everyone wants there account hacked then it's probably a good idea to make it longer & harder to guess... –Davey2010^Talk 04:38, 10 November 2015 (UTC)
17. This seems about right.- MrX 16:43, 11 November 2015 (UTC)
18. This is standard for most websites, in my admittedly limited experience. Mz7 (talk) 04:39, 14 November 2015 (UTC)
19. Support 8 bytes This is not an unreasonably high standard, and many web sites and online services require 8-byte passwords (or longer). While not long enough to make a brute-force attack impossible, it is long enough to make it non-trivial with current technology, and is short enough that few if any users will be discouraged. However, note that this would not have prevented the recent compromises. DES ^(talk) 17:42, 17 November 2015 (UTC)
20. Per above First choice before 6 bytes. ---- Patar knight - ^chat/_{contributions} 04:01, 20 November 2015 (UTC)
21. This strikes a good balance. Stifle (talk) 10:23, 23 November 2015 (UTC)
22. This is OK. NinjaRobotPirate (talk) 01:11, 25 November 2015 (UTC)
23. Yes, this is better than 6 bytes. jni ^(delete)_{...just not interested} 18:29, 26 November 2015 (UTC)
24. Sufficient enough to prevent breaches that aren't through simple password reuse, as long as other complexity requirements are made. LFaraone 04:29, 30 November 2015 (UTC)
25. Yes better, and reasonable enough. Yann (talk) 10:04, 30 November 2015 (UTC)
26. Chris Troutman (talk) 21:21, 5 December 2015 (UTC)

Oppose Length increase to 8 bytes

1. As the problems we have encountered to date are due to people's possibly complex passwords having been revealed elsewhere, I oppose all options that make passwords more proscriptive and awkward for users, except for at least a minimum standard of commonsense. --Dweller (talk) 11:27, 5 November 2015 (UTC)

   Disagree with precept. DoB is not a "complex password". All the best: Rich Farmbrough, 14:04, 6 November 2015 (UTC).
   

2. Far too short. Even with 95 base characters upper/lower alphnumeric +33 others, that's less than 10^16 combinations. --RexxS (talk) 03:01, 7 November 2015 (UTC)
3. Too small. This gives anyone with a CUDA-based password guesser the ability to do offline cracking,giving them access to any Wikipedia account that used a minimum-length password. Also, an RfC is the wrong answer here; technical problems with technical solutions should not be voted on by a collection of a few experts and a large number of non-experts. --Guy Macon (talk)
4. Creates a false sense of security. For the purpose of a dictionary attack, 1 character is as good as 6 or 8. --Pgallert (talk) 18:23, 26 November 2015 (UTC)

The minimum length of a password should be increased from 1 byte to 16 bytes.

Support Length increase to 16 bytes

1. Per this. sst✈^discuss 13:44, 5 November 2015 (UTC)
2. Super High School Level Support In this day and age, why take chances? Is it really that hard for people to download say, KeePassX, and then have a random password of any length generated via a rather convenient GUI? I think not. The future must be considered. With ever expanding resources, malicious third parties are a force to be reckoned with. Again, why take chances? (For all the convenience arguments, look up KeePass) --DSA510 Pls No Bully 05:45, 6 November 2015 (UTC)
3. With just upper and lower case that's more than 10^27 combinations, which is adequate. Add in numbers and you have over 10^28. Incidentally, adding in 33 punctuation characters only improves that to 4 x 10^31 and makes it near impossible to remember. Password strength is far more sensitive to length of password that it is to the number of characters you pick from. https://xkcd.com/936/ --RexxS (talk) 03:10, 7 November 2015 (UTC)
4. I am assuming that, for instance, if "length increase to 16 bytes" and "impose restriction on admins" gain consensus [and "impose restriction on all users" doesn't], that this means that a 16 byte restriction will be applied to admins only. Given this, my support for this proposal is conditional on the minimum length increase only being applied to a specific user group (e.g. people with AWB rights, 'admins or higher'). This would render arguments below like "this may even deter some people from signing up" redundant. — Bilorv_(talk)^(c)(e) 17:41, 20 November 2015 (UTC)
5. This is an excellent way of making sure that someone does not pick a Wikipedia password that they are already using on other sites. Also, an RfC is the wrong answer here; complex technical problems with a variety of technical solutions should not be decided by having a small subset of the available solutions voted on by a collection of a few experts and a large number of non-experts. --Guy Macon (talk) 21:37, 20 November 2015 (UTC)
6. I don't think I'm special, and I can memorize a 16 character alphanumeric string. I guess it's academic, though, as this isn't going to pass. NinjaRobotPirate (talk) 01:25, 25 November 2015 (UTC)
7. Chris Troutman (talk) 21:21, 5 December 2015 (UTC)

Oppose Length increase to 16 bytes

1. Not many people will want to remember a 16-character password. This may even deter some people from signing up. epic genius (talk) 14:16, 5 November 2015 (UTC)
2. Strong oppose As the problems we have encountered to date are due to people's possibly complex passwords having been revealed elsewhere, I oppose all options that make passwords more proscriptive and awkward for users, except for at least a minimum standard of commonsense. --Dweller (talk) 14:19, 5 November 2015 (UTC)
3. I've yet to decide on 6 or 8 characters, but 16 is certainly overkill. Sam Walton (talk) 15:38, 5 November 2015 (UTC)
4. Overkill. Coming up with a secure password of this length would in itself deter sign-ups. BethNaught (talk) 19:24, 5 November 2015 (UTC)
5. No need for a password this long. -- GB fan 20:13, 5 November 2015 (UTC)
6. Overkill. Many users will resort to writing such PWs down in insecure places, or will use "easy to recall" and in many cases easier to crack PWs. May also deter sign-ups. No evidence that breaches were due to brute-force attacks, which is the only case this helps with. DES ^(talk) 01:31, 6 November 2015 (UTC)
7. Too long; will only be confusing for most people. Do any other websites require passwords this long? — Earwig ^talk 09:03, 6 November 2015 (UTC)
8. Too much. JohnCD (talk) 22:19, 6 November 2015 (UTC)
9. People won't remember their passwords. Mkdw^talk 22:21, 7 November 2015 (UTC)
10. Still too short!, Make it 87 that should do it. –Davey2010^Talk 04:40, 10 November 2015 (UTC)
11. Excessive long. We're not protecting the Crown jewels.- MrX 16:44, 11 November 2015 (UTC)
12. 16 is too long and would potentially deter users from signing up. Mz7 (talk) 04:38, 14 November 2015 (UTC)
13. The accounts mentioned in the heading were hacked due to usew of the password on other sites; the harder we make the passwords to remember, the more likely users are to make that mistake. עוד מישהו Od Mishehu 22:23, 15 November 2015 (UTC)
14. Per above Seems excessive. ---- Patar knight - ^chat/_{contributions} 04:01, 20 November 2015 (UTC)
15. Length is not entropy! Longer passwords don't automatically make better passwords. What is far more likely is that they will be written down. HighInBC 01:40, 22 November 2015 (UTC)
16. Oppose, people will either write passwords down, forget them, or add repeated characters to the end. Stifle (talk) 10:23, 23 November 2015 (UTC)
17. Nobody outside IT or mathematics can pick a non-trivial password of this size, and remember it without writing it down somewhere. --Pgallert (talk) 18:23, 26 November 2015 (UTC)

A password should require at least 1 uppercase and 1 lowercase letter.

Support Case requirements

1. I would support this requirement. Worm^TT(talk) 10:47, 5 November 2015 (UTC)
2. Support Where I work, it's a requirement that passwords have at least one uppercase and one symbol! KoshVorlon 11:47, 5 November 2015 (UTC)
3. Support though theyre should be some options. 3 out the 4 such as 1 lower 1 uper 1 number 1 symbol gives flexibility as you have no way of knowing which 3 have been chosen. Amortias (T)(C) 12:29, 5 November 2015 (UTC)
4. If it contains a lowercase Latin alphabet character, it should also contain an uppercase Latin alphabet character. And vice versa. That is enough, and avoids any potential language issues (although I think that is not a real issue when it comes to this English-speaking wiki). At this stage in the proceedings, the only thing being supported is to require admin accounts to have password at least 8 characters long, making password an acceptable password - which is plainly ridiculous. — This, that and the other (talk) 08:59, 6 November 2015 (UTC)
5. It's relatively easy to remember upper and lower case combinations, and increasing the number of characters to choose from 26 to 52 gives a useful increase in strength. For example, a 12 character password consisting of only lower case gives 10^17 combinations, while 12 upper/lower case characters provides 3 x 10^21 combinations. --RexxS (talk) 03:12, 7 November 2015 (UTC)
6. I agree, per the above comments. Sam.gov (talk) 21:48, 13 November 2015 (UTC)
7. Chris Troutman (talk) 21:21, 5 December 2015 (UTC)

Oppose Case requirements

1. I oppose this, and numerical and symbol for the same reason. Forcing a password to have these requirements makes it easier to crack because it reduces the possible set of passwords. That is, a brute force attack takes less effort if the target is known to contain one or more uppercase, lowercase, number and symbol. Therefore, I prefer a "minimum complexity" requirement which ensures the password is strong without forcing it to contain particular sets of symbols. QuiteUnusual (talk) 11:04, 5 November 2015 (UTC)
2. As the problems we have encountered to date are due to people's possibly complex passwords having been revealed elsewhere, I oppose all options that make passwords more proscriptive and awkward for users, except for at least a minimum standard of commonsense. --Dweller (talk) 11:27, 5 November 2015 (UTC)
3. You already know, this WTT, we discussed it yesterday off-wiki. Upper/lower case letters work only for passwords that are written in latin languages. This rule demands the use of latin characters in a password, which is not okay. There is also zero evidence that this makes people's passwords more secure. Risker (talk) 11:38, 5 November 2015 (UTC)

   I don't disagree, I'm putting forward all the suggestions which have been put forward by the WMF Security chap. That said, I'd support it, on the basis that forcing people to think about their password is a good thing. Worm^TT(talk) 11:43, 5 November 2015 (UTC)

   The list of "Unicode Characters in the 'Letter, Uppercase' Category" can be found at http://www.fileformat.info/info/unicode/category/Lu/list.htm - as well as Latin it includes (for example) Cyrillic and Cherokee (e.g. Ꮨ).

   However you are right that some scripts do not have the distinction. It is trivial to exempt these in a Posix environment :

   if (toupper (password) === tolower (password)) {continue;}

   though other checks would probably be war rented if one was going down this route.

   All the best: Rich Farmbrough, 20:17, 5 November 2015 (UTC).
   

4. well, yes, but not this- because of language.--Müdigkeit (talk) 11:56, 5 November 2015 (UTC)
5. Per the above reasons; length is more important than this. Sam Walton (talk) 12:07, 5 November 2015 (UTC)
6. Many users use non-latin passwords. Forcing different cases does not enhance security much anyway. sst✈^discuss 13:42, 5 November 2015 (UTC)
7. One uppercase and one lowercase != harder to crack. What if I had a password that was my username, plus or minus a single character? It would be unscrambled in 2 seconds flat. epic genius (talk) 14:17, 5 November 2015 (UTC)
8. I can easily remember a 16-character password, in fact I don't even have to remember it, if it consists of the first letters of the words in a ≈16-word sentence that means something to me. Say a quote — not the opening lines of Pride and Prejudice but something obscure that's meaningful to me personally — something I already know by heart. That's easy. Remembering a nerds' delight of caps and symbols and numericals is hard even if it's short. Do I have to put this argument in five or six places below, too? Sorry, Worm, it's a good idea to collect opinions on this issue, but the way it's set up, and split up, is a bit of a nerds' delight in itself. I'd rather not bore everybody with versions of my suggestion all over the page. I support a 16-bit requirement for administrators. Bishonen | talk 15:57, 5 November 2015 (UTC).

   That'll be my brain in play... it's how it made sense to me - unfortunately! Worm^TT(talk) 16:03, 5 November 2015 (UTC)

9. This is not been shown to be an effective deterrent and can make passwords more difficult to remember. Beeblebrox (talk) 18:50, 5 November 2015 (UTC)
10. Passwords do not need character type requirements to be secure: see Diceware. BethNaught (talk) 19:24, 5 November 2015 (UTC)
11. See my answer below. But this has a worse effect. All the best: Rich Farmbrough, 20:05, 5 November 2015 (UTC).
    
12. The main purpose of this is to block PWS susceptible to dictionary attacks. It is not a bad idea for systems where PWs are always entered in the Latin charset. (a 3 out of 4 types as mentioned above is better). But a complexity test is much better, and can apply to unicode passwords. — Preceding unsigned comment added by DESiegel (talk • contribs) 01:33, 6 November 2015 (UTC)
13. Case requirements have always struck me as a bad idea, because they place limits on the sets of characters used for passwords. Less available characters are always more open to brute force attacks. See Rich's analysis below.--Jayron32 01:47, 6 November 2015 (UTC)
14. This makes passwords harder to memorize, without making them any more secure. If you require a capital letter, it's a virtual certainty that that letter will be the first one. --Carnildo (talk) 02:37, 6 November 2015 (UTC)
15. Oppose specific requirements like this one, since it does not add true security and only inconveniences users. Others have explained above in better detail. — Earwig ^talk 09:03, 6 November 2015 (UTC)
16. Per above. JohnCD (talk) 22:21, 6 November 2015 (UTC)
17. No. Opposition based on that this has not been shown to be effective. Agree also that this adds inconveniences to user. That dratted caps lock... Fylbecatulous talk 16:11, 8 November 2015 (UTC)
18. I already use an uppercase and lowercase and even a full stop but I guess having it as an official thing could perhaps inconvience alot of people and if there's no security benefits then it's kinda pointless. –Davey2010^Talk 04:45, 10 November 2015 (UTC)
19. Let users choose whatever case they prefer and use a variety of methods of strengthening their password as see fit.- MrX 16:47, 11 November 2015 (UTC)
20. Oppose - This adds significant inconvenience to the user, while not making it any easierharder to crack the account. עוד מישהו Od Mishehu 22:25, 15 November 2015 (UTC)
21. Per above Seems too arbitrary. Many fine passwords without this. ---- Patar knight - ^chat/_{contributions} 04:01, 20 November 2015 (UTC)
22. The password "Password" is incredibly insecure. The password "mypasswordistoolongtobruteforce" is very secure [or would be if I hadn't written it here]. Forcing people to use mixed case letters—or realistically, a single uppercase letter at the start of the password—helps very little. — Bilorv_(talk)^(c)(e) 17:41, 20 November 2015 (UTC)
23. Wrong answer to the problem. --Guy Macon (talk) 21:42, 20 November 2015 (UTC)
24. Not useful. Everyone will just put the first character of the password in uppercase. Stifle (talk) 10:24, 23 November 2015 (UTC)
25. Oppose Prevents "correct horse battery staple" jni ^(delete)_{...just not interested} 18:29, 26 November 2015 (UTC)

Comments

• @QuiteUnusual:; whilst requiring 1 or more of a certain character does reduce the overall password set, the intention of such a rule is to ensure that *all* passwords are within the largest set possible. Given that most people tend to use the quickest possible solution, you'll find that most people are in a much more reduced set (as in; lower case characters of 4-9 letters) which leaves them at risk. This sort of policy increases the overall average entropy of the entire password pool. Or in another way; it raises minimum-entropy value of the password set. At the same time it excludes only low-entropy sets (e.g. all lower or all upper case) so the maximum-entropy value passwords are unaffected. The overall result is to force an increase in the median/mean entropy of the password pool. It's one of the most effective ways of improving average password complexity. --Errant ^(chat!) 10:45, 9 November 2015 (UTC)
• @Od Mishehu: I think you mean "... while not making it any harder to crack the account", but anyway, that's demonstrably untrue: "correct horse battery STAP" is in a set that is 72 million times larger than the obvious set that contains "correct horse battery stap", and I just don't accept that it is any more difficult to remember. --RexxS (talk) 15:50, 16 November 2015 (UTC)
  • I didn't say that my opposition here is about ease of memory; I said that it's about the inconvenience - even on a desktop computer, this would be somewhat inconvenient, and certainly on many mobile devices where it would mean switching keyboards. And users would tend to group the upper and lower case letters, making the likely group of passwords significantly smaller. עוד מישהו Od Mishehu 21:28, 16 November 2015 (UTC)

A password should require at least one numerical character - i.e. 0-9

Support Numerical requirements

1. I would support this requirement. Worm^TT(talk) 10:47, 5 November 2015 (UTC)
2. Support per the statement I made above KoshVorlon 11:48, 5 November 2015 (UTC)
3. Support though theyre should be some options. 3 out the 4 such as 1 lower 1 uper 1 number 1 symbol gives flexibility as you have no way of knowing which 3 have been chosen. Amortias (T)(C) 12:29, 5 November 2015 (UTC)
4. Atleast to me it's common sense to have a number on the end anyway..... –Davey2010^Talk 04:50, 10 November 2015 (UTC)
5. I would go for this as well. Sam.gov (talk) 21:55, 19 November 2015 (UTC)
6. Chris Troutman (talk) 21:21, 5 December 2015 (UTC)

Oppose Numerical requirements

1. As the problems we have encountered to date are due to people's possibly complex passwords having been revealed elsewhere, I oppose all options that make passwords more proscriptive and awkward for users, except for at least a minimum standard of commonsense. --Dweller (talk) 11:27, 5 November 2015 (UTC)
2. Not effective. sst✈^discuss 13:48, 5 November 2015 (UTC)
3. Also not effective, per the above. If I had a password that was my birth date ("Feb 25 1998", for example), it would be very easy to crack. epic genius (talk) 14:19, 5 November 2015 (UTC)
4. I agree, this is not an effective deterrent. Beeblebrox (talk) 18:51, 5 November 2015 (UTC)
5. Passwords do not need character type requirements to be secure: see Diceware. BethNaught (talk) 19:24, 5 November 2015 (UTC)
6. Oppose

Thus imposing this requirement reduces the number of possibilities substantially. It does not rule out "11111AAAAA".

All the best: Rich Farmbrough, 19:33, 5 November 2015 (UTC).

7. Oppose per Rich. Limits on available characters always makes hacking easier, not harder. Once you've defined parameters more strictly, you've limited the available choices, and made cracking easier, not harder. --Jayron32 01:49, 6 November 2015 (UTC)
8. Oppose: In practice, this makes passwords less secure. Just as a required capital letter will be the first one in the password, a required number will be the last one -- and that digit takes the place of a more-secure letter. --Carnildo (talk) 02:39, 6 November 2015 (UTC)
9. Oppose per above section. — Earwig ^talk 09:03, 6 November 2015 (UTC)
10. Oppose per above. JohnCD (talk) 22:22, 6 November 2015 (UTC)
11. What Rich said.. Risker (talk) 05:50, 7 November 2015 (UTC)
12. Not especially effective. Let users choose whatever characters they prefer and use a variety of methods of hardening their password.- MrX 16:50, 11 November 2015 (UTC)
13. Per above Seems too arbitrary. Many fine passwords without this. ---- Patar knight - ^chat/_{contributions} 04:01, 20 November 2015 (UTC)
14. The password "password1" is incredibly insecure. The password "mypasswordistoolongtobruteforce" is very secure [or would be if I hadn't written it here]. Forcing people to use a number helps very little. — Bilorv_(talk)^(c)(e) 17:41, 20 November 2015 (UTC)
15. Wrong answer to the problem, popular among those who do not understand the math. --Guy Macon (talk) 21:44, 20 November 2015 (UTC)
16. Oppose. People will simply append 1 to the end of the password. Stifle (talk) 10:24, 23 November 2015 (UTC)
17. Oppose Prevents "correct horse battery staple" jni ^(delete)_{...just not interested} 18:29, 26 November 2015 (UTC)
18. Oppose Reduces the number of available passwords while making them hard to remember. The set of words, quotes or other letter strings that can be meaningful to a person is huge. The number of numbers that will be will be much smaller and probably quite crackable (I would expect a lot of dates which anyone can pull off Facebook). Happy Squirrel (talk) 20:34, 3 December 2015 (UTC)

A password should require at least one symbol.

Support Symbol requirements

1. I would support this requirement Worm^TT(talk) 10:47, 5 November 2015 (UTC)
2. Support BUT be careful, as Wikipedia uses a SQL database, certain symbols and SQL just don't go together (won't share, per WP:BEANS), so IF we do all them, make sure there's text saying which symbols cannot be used as well. KoshVorlon 11:49, 5 November 2015 (UTC)

   I sincerely hope that passwords are stored encrypted, so this shouldn't be a problem. Will check though. Worm^TT(talk) 11:53, 5 November 2015 (UTC)

   Hashed (don't mean to be pedantic, but in this discussion such distinctions are important). And they are, so this is not a concern. — Earwig ^talk 16:32, 5 November 2015 (UTC)

   Indeed it may still be a concern, depending on how the password is handled before it is hashed. For example a test against a dictionary might be standard, which means that string still needs cleaning, or at least careful handling. All the best: Rich Farmbrough, 19:39, 5 November 2015 (UTC).
   

   This is not a concern (Im stating this as a developer). In addition to the password being hashed, we also properly escape all sql queries. You should feel free to use any valid unicode character in your password (overly pendantic note: except maybe non-whitespace ascii control characters, as MW doesnt let those be input in general. Also, Everything gets converted to NFC, so if you use a non-NFC passsword it will get converted to NFC). BWolff (WMF) (talk) 22:20, 15 November 2015 (UTC)

3. Support though theyre should be some options. 3 out the 4 such as 1 lower 1 uper 1 number 1 symbol gives flexibility as you have no way of knowing which 3 have been chosen. Amortias (T)(C) 12:29, 5 November 2015 (UTC)
4. Chris Troutman (talk) 21:21, 5 December 2015 (UTC)

Oppose Symbol requirements

1. As the problems we have encountered to date are due to people's possibly complex passwords having been revealed elsewhere, I oppose all options that make passwords more proscriptive and awkward for users, except for at least a minimum standard of commonsense. --Dweller (talk) 11:27, 5 November 2015 (UTC)
2. Symbols become seriously problematic when trying to log in from non-desktop situations, and there is no evidence that any of the password cracking situations we have seen to date would have been changed by this requirement. 13:09, 5 November 2015 (UTC) — Preceding unsigned comment added by Risker (talk • contribs)
3. Per Risker. sst✈^discuss 13:50, 5 November 2015 (UTC)
4. Not going to help unless you want editors to only edit on tablets and computers, or unless you have uppercase, numeral, AND symbol requirement. epic genius (talk) 14:20, 5 November 2015 (UTC)
5. Again, not an effective deterrent. Beeblebrox (talk) 18:52, 5 November 2015 (UTC)
6. Passwords do not need character type requirements to be secure: see Diceware. BethNaught (talk) 19:24, 5 November 2015 (UTC)
7. Oppose per Rich in section above. Forcing certain characters places limiting parameters on passwords, and makes them easier to hack. --Jayron32 01:50, 6 November 2015 (UTC)
8. Oppose: Just like a required digit makes passwords less secure, a required symbol does as well, only more so: the symbol usually comes from one of "!@#$%^&*", and like a required digit, is the last character of the password. --Carnildo (talk) 02:41, 6 November 2015 (UTC)
9. Oppose this one especially. — Earwig ^talk 09:03, 6 November 2015 (UTC)
10. Oppose per above. JohnCD (talk) 22:23, 6 November 2015 (UTC)
11. This makes remembering a password so much more difficult for a small increase in strength. An 11-character [alphanumeric+punctuation] password is no stronger than a 12-character alphanumeric one, and 186 times weaker than a 13-character purely alphabetic one. Length >> complexity. --RexxS (talk) 03:25, 7 November 2015 (UTC)
12. I too oppose this one especially. Per all above. Fylbecatulous talk 16:23, 8 November 2015 (UTC)
13. .... This would never work as to find a symbol would take forever for a start, All's it would lead to is a very sharp decline in editing here. –Davey2010^Talk 04:52, 10 November 2015 (UTC)
14. Not especially effective. Let users choose whatever characters they prefer and use a variety of methods of hardening their password.- MrX 16:52, 11 November 2015 (UTC)
15. Per above Seems too arbitrary. Many fine passwords without this. ---- Patar knight - ^chat/_{contributions} 04:01, 20 November 2015 (UTC)
16. The password "password." is incredibly insecure. The password "mypasswordistoolongtobruteforce" is very secure [or would be if I hadn't written it here]. Forcing people to use a symbol helps very little. — Bilorv_(talk)^(c)(e) 17:41, 20 November 2015 (UTC)
17. Wrong answer to the problem, makes passwords a lot harder to remember. Longer passwords are far more secure than shorter passwords with symbols.
18. Oppose Prevents "correct horse battery staple" jni ^(delete)_{...just not interested} 18:29, 26 November 2015 (UTC)
19. Oppose Just as in the required digit case, but even worse. Some really nonsensical string of uncommon words (or string of first letters from a quote) is probably the best password. You have tons of choices. Now force me to punctuate it. You then have to either be a natural at memorizing punctuation, or pick some kind of string with natural punctuation. The later vastly reduces the number of available strings. Happy Squirrel (talk) 20:40, 3 December 2015 (UTC)

A password should not be in the list of the 10,000 most common passwords.

Support Uncommon passwords

1. I would support this requirement. Worm^TT(talk) 10:47, 5 November 2015 (UTC)
2. This is a cheap way of preventing dictionary attacks. --Carnildo (talk) 02:43, 6 November 2015 (UTC)
3. Not necessarily 10,000, but some restriction for the absolutely most common passwords does not seem like a bad idea. Things like "12456" and "qwerty": strings someone could guess on a whim. — Earwig ^talk 09:03, 6 November 2015 (UTC)
4. Sounds like a good idea. APerson (talk!) 14:17, 6 November 2015 (UTC)
5. Useful, but not necessary. Using four items from the list of 10,000 most common passwords gives 10^16 combinations against a dictionary attack - still better than 8 characters taken from the set of alphanumeric + punctuation. --RexxS (talk) 03:31, 7 November 2015 (UTC)
6. Definitely. I would also like for the system to disallow single dictionary words as passwords.- MrX 16:53, 11 November 2015 (UTC)
7. Support, provided we make a list of these most common passwords in alphabetical order. עוד מישהו Od Mishehu 22:27, 15 November 2015 (UTC)
8. Support. Indeed I would support also "Password must not be a dictionary word." DES ^(talk) 17:51, 17 November 2015 (UTC)
9. Per above Seems sensible, though 10, 000 might be a bit much. ---- Patar knight - ^chat/_{contributions} 04:01, 20 November 2015 (UTC)
10. Support, but 10,000 is too small a number. Also, an RfC is the wrong answer here; complex technical problems with a variety of technical solutions should not be decided by having a small subset of the available solutions voted on by a collection of a few experts and a large number of non-experts. --Guy Macon (talk) 21:50, 20 November 2015 (UTC)
11. Support any trivial to guess password should not be allowed. HighInBC 01:42, 22 November 2015 (UTC)
12. Support, that seems sensible. Stifle (talk) 10:28, 23 November 2015 (UTC)
13. Support Reasonable. Yann (talk) 10:11, 30 November 2015 (UTC)
14. Chris Troutman (talk) 21:21, 5 December 2015 (UTC)

Oppose Uncommon passwords

1. I'm tentatively here, I think 10,000 is probably overkill. Callanecc (talk • contribs • logs) 11:18, 5 November 2015 (UTC)
2. Such a list of passwords would have to be from a website that is not Wikipedia. Who gets to decide which website to choose? sst✈^discuss 13:49, 5 November 2015 (UTC)
3. Tentative oppose unless WMF is willing to maintain a list of 10,000 most common passwords. In theory, this is a good idea, but in practice, if someone wants to create a weak password on purpose, let them do it. epic genius (talk) 14:21, 5 November 2015 (UTC)

   The WMF would be the ones who hold the list of 10,000 passwords. I expect they will keep them up to date from whatever source they'd get them from. Worm^TT(talk) 08:38, 6 November 2015 (UTC)

4. Commonsense should apply .... If someone wants to create a password like "Banana1" then they should knock themselves out,,,, literally!. –Davey2010^Talk 04:56, 10 November 2015 (UTC)

Comment Uncommon passwords

• Who on earth decides what the 10,000 most common passwords are? --Dweller (talk) 11:28, 5 November 2015 (UTC)

  I guess there would be a list somewhere of common passwords which are any new password is checked against. The 10,000 figure was suggested by the WMF Security chap, we could always reduce the number. I think the point is that common passwords are rejected. Worm^TT(talk) 11:33, 5 November 2015 (UTC)

  I've seen these published and used them at work. Typically they contain the obvious (like "qwerty", "password"), profanities, phrases like "Starwars", standard sequences like 12345 or abcde, repeating characters and others. I don't know how these lists were generated though. QuiteUnusual (talk) 11:44, 5 November 2015 (UTC)

  These lists are generated by a number of means, the most common is brute-forcing large password files that have been hacked and published on t' Internet. All the best: Rich Farmbrough, 20:26, 5 November 2015 (UTC).
  

  These common password lists are generally maintained by the people who do a lot of the actual password cracking in the first place. There are some common lists available and each individual cracker also has their own personalized list. They are based off of what passwords have been found in the past with high frequency (hence why there will be some various based on the particular cracker doing the work). Basically, any password on these lists won't last much more than a minute against a real world cracker as they are among the first things tested. In fact almost all of the phases of password cracking make use of these lists(lots of passes that add common prefix/suffix to the list as well). By taking one of the lists and prohibiting people from using any PW on the list, the overall security goes up substantially. Aaronspink (talk) 02:59, 6 November 2015 (UTC)

  For reference, one potential list https://github.com/danielmiessler/SecLists/blob/master/Passwords/10_million_password_list_top_10000.txt?raw=true . Bawolff (talk) 23:45, 23 November 2015 (UTC)

• I would rather see this kind of list first as I think that 10,000 might be a few too many. I could definitely support not using some number of the most common passwords though. Sam Walton (talk) 12:08, 5 November 2015 (UTC)

  There is risk of an attack that could give an attacker large number of log-in attempts, in the nature of several thousand up to hundreds of thousands, depending on how proactive the Foundation is. Statistically 10,000 isn't that great in htis context (birthday paradox).

  All the best: Rich Farmbrough, 20:26, 5 November 2015 (UTC).
  

  10,000 is very small (If there exists a list somewhere with your password on it, your password is probably too simple). However. I don't think the birthday paradox is relavent to the matter at hand (Passwords aren't chosen uniformly from some set, so probability of a collision is worse than what the birthday paradox would suggest, but collisions don't matter in terms of chosing a password (as far as i can tell)). Bawolff (talk) 23:52, 23 November 2015 (UTC)

• Here is a link I found that discusses common passwords and where the 10,000 number come from. -- GB fan 20:31, 5 November 2015 (UTC)
• How about just banning any password that has all numbers and is 8 characters or below? That oughta remove the birthday paradox problem. epic genius (talk) 00:50, 6 November 2015 (UTC)
• A 10,000-password list is actually quite small. For comparison, the default wordlist for Linux's "cracklib" security module has 1.6 million entries. --Carnildo (talk) 03:21, 6 November 2015 (UTC)
• Okay with this, but to be honest it should be applicable to *all* passwords on account creation and reset, regardless of access level, on top of being required if access level changes to a higher level. Risker (talk) 05:52, 7 November 2015 (UTC)
• This has been implemented and merged into MediaWiki. A configuration change is necessary for deployment. MER-C 21:42, 4 December 2015 (UTC)

To ensure that the strength of the password is sufficent to resist a persistent brute force attack, those users who are subject to heightened password scrutiny will be required to devise a password of sufficent strength to resist attack for no less than 7 days. The WMF foundation will run an estimate on the relative strength of the password and evaluate it against the time it would take to brute force the password.

Support Complexity requirement

1. Putting this proposal down so it's descriptive and doesn't lay down exactly what requirements you must be between X and y characters long, what casing/special cahracters/numbers/etc. are in it. Hasteur (talk) 16:10, 5 November 2015 (UTC)
2. Tentative support depending on implementation details. DES ^(talk) 01:37, 6 November 2015 (UTC)
3. It is perfectly possible to create strong passwords that are easily remembered. The well-known xkcd version of "correct horse battery staple" is now considered a little weak with only about 44 bits of entropy (around 2 x 10^13 combinations). My current preference is to use a short sentence that contains numbers and a proper name like "9 out of 10 editors mock Jimbo." That's 30 characters, but who could forget it? and does anybody seriously think that even with pattern-matching and dictionary strategies, that's weaker than any of the impossible-to-remember suggestions we have in the discussion above? --RexxS (talk) 03:47, 7 November 2015 (UTC)
4. This a good concept that I've seen used in other systems. As a user attempts to choose a password, the system assigns a score. A minimum score would have to be achieved for the password to be accepted. It's also a great way for users to learn how to choose secure passwords.- MrX 16:57, 11 November 2015 (UTC)
5. Support, but the devil is in the details. The strength checker needs to say that "nine out of ten wikipedia editors love jimbo" is strong, "Wikipedia; The Free Encyclopedia That Anyone Can Edit" is weak, "btulvkzhrrmnjgcmqeae" is strong and "6Kx4#Nf!" is weak. --Guy Macon (talk) 22:09, 20 November 2015 (UTC)

Oppose Complexity requirement

1. This is impossible to enforce. For any definition of "strength" beyond "is it on any list of common passwords", the strength is simply a wild guess, based on the assumption that an attacker is using the same set of password-generation patterns that the strength checker is. --Carnildo (talk) 02:47, 6 November 2015 (UTC)
2. Has no bearing on the reality of how almost all passwords are compromised in almost all settings: repeated use of the same password over multiple sites or accounts, selecting passwords that could well meet the complexity requirements but can be deduced if someone knows a little bit about the account holder, and not being cautious about keeping one's password secure. Every known abuse of an admin (or higher) account has been because of one of these issues, not because one's password wasn't complex enough, and that's the situation for almost all hacked accounts on almost all sites. Seriously, people. Admin accounts are easily blocked. And we're not talking nuclear launch codes here, we're talking about a website that's widely known to be vandalized thousands of times per hour. Risker (talk) 05:21, 7 November 2015 (UTC)

   Well, actually it does. By not stating the method of choosing candidate attack passwords these issues are elided. But obvious (and well published) methods, all known compromised passwords (from every account on every system) are tried, and all terms relating to the user. This second part so well established that a filk song was written about it back in the 70s or 80s

   Try his first wife's maiden name,

   This is more than just a game,

   It's real fun, but just the same,

   It's hacking, hacking, hacking.

   All the best: Rich Farmbrough, 14:24, 7 November 2015 (UTC).
   

   Rich, could you reformat the above so that it doesn't reset the !vote count to 1? Thanks! --Guy Macon (talk) 22:09, 20 November 2015 (UTC)

   Maybe that's part of the hack! All the best: Rich Farmbrough, 22:30, 20 November 2015 (UTC).
   

3. How on earth am I supposed to figure out if my password meets this rule? עוד מישהו Od Mishehu 22:28, 15 November 2015 (UTC)
4. Per above Seems inferior to a "relative strength" password advice bar when creating passwords. ---- Patar knight - ^chat/_{contributions} 04:01, 20 November 2015 (UTC)
5. Estimating the complexity of a password is far from accurate. Also I am not showing my password to anyone. HighInBC 01:43, 22 November 2015 (UTC)

Comment Complexity requirement

• How does the WMF estimate the relative strength of a password without either trying to crack it or having you tell it to them? — Earwig ^talk 16:37, 5 November 2015 (UTC)
  • @The Earwig: Prior to hashing the password down to what gets stored in the database, WMF hands the password over to a standardized library to evaluate the strength of the password (i.e. the entropy in it). Anything below a certain threshold that WMF establishes for users that have a higher scrutiny gets rejected for the user to retry. The password is available prior to the hashing in cleartext so WMF can run the estimate on it. Yes this means changing your password will take a little longer but ensures we get higher quality passwords (as defined by the entropy in them) without resorting to arbitrary rules. Hasteur (talk) 16:46, 5 November 2015 (UTC)
  • There are library routines, if I am not mistaken, which can perform such a check on the fly, and approve or disapprove as a user enters the PW. Using one seems like a good idea. — Preceding unsigned comment added by DESiegel (talk • contribs) 01:37, 6 November 2015 (UTC)
• What hardware budget and hashing algorithm will be used for this comparison? MER-C 17:41, 14 November 2015 (UTC)
  • MER-C I would estimate that the comparison should be no more than $200 for an enterprise level library estimate (or it could be replaced by a Free, Libre, Open Source Software (F-OSS) library as well), but at the same time it only kicks in when the restricted user is choosing a new password. The hashing down is already done (because wikipedia doesn't store the cleartext passwords in the database). Hasteur (talk) 16:51, 16 November 2015 (UTC)
    • I was referring to the requirement about "resist[ing] attack for no less than 7 days" -- i.e. how much the theoretical adversary is willing to spend on GPUs, FPGAs or ASICs to speed up the attack. Are we talking backyard (someone with a Titan X or two = $1000 each), cybercrime gang (~$100k), nation state (millions) or NSA type resources? The ability to crack scales linearly with budget, but shrinks exponentially with complexity. I also found out MediaWiki uses SHA-256 ... not the best algorithm for password hashing, but secure for now. MER-C 17:07, 16 November 2015 (UTC)
      • In that question I would say somewhere in the range of a cybercrime gang. Keeping in mind that most of the delay is going to be sending the password attempt over (with the login) to see if it works. I would estimate ~0.5 seconds as a best case scenario for a single attempt. A home hobbyist isn't going to be brute forcing an admin's password. If a nation state starts pushing on the door, they're going to get in (unless they already have moles planted). We may also want the foundation to explain how many bad attempts triggers a timeout on attempting more passwords. Hasteur (talk) 17:24, 16 November 2015 (UTC)
        • Cybercrime gang is probably about right. There is some real money available for anyone who can sneak advertising unto Wikipedia undetected, and some might see compromising the accounts of an admin of even a WMF staffer as a way to accomplish that. It wouldn't work, of course, but we can't count on the cybercriminal figuring that out until he tries it a few times. --Guy Macon (talk) 00:09, 22 November 2015 (UTC)
          • If bad attempts cause a timeout on attempting more passwords, then anyone who is willing to run a script 24/7 on their home PC will be able to lock out anyone on Wikipedia who annoys them. --Guy Macon (talk) 00:14, 22 November 2015 (UTC)

This is self-explanatory and easy to make. Such examples include this or this. This "password strength bar" would be placed above, below, or next to the input boxes for "Enter your password." It would be just a recommendation (this doesn't really work with passwords created via diceware), but combined with the character length and possible uppercase/lowercase/number/symbol requirements, a password that generates a "red" bar or a "weak password" notification would probably not be allowed to proceed.

Support Add a password strength bar

1. Proposing this so new users could know whether their password is secure. epic genius (talk) 16:25, 5 November 2015 (UTC)
2. Many other websites already do this, and I certainly can't see the harm in doing it here. Although I personally would only want someone actually stopped from using a weak password if they were an admin, functionary, etc. Beeblebrox (talk) 18:54, 5 November 2015 (UTC)

   Maybe even then only if it is less strong than their previous password... but suppose the previous password was compromised, or part compromised? All the best: Rich Farmbrough, 19:42, 5 November 2015 (UTC).
   

   @Rich Farmbrough: The problem is that once the password has been accepted, it gets hashed down (because storing passwords in a reversable encryption is unbelievably dangerous and hashing is a one way function and difficult to computationally reverse). Your subsuggestion also runs the risk of strength creep where each time a user who is subject to the higher scrutiny will have to come up with increasingly more difficult passwords. Hasteur (talk) 19:19, 12 November 2015 (UTC)

   @Hasteur:

   1. When someone is changing a password the old password is also given. Hence there is no need for reversible encryption.
   2. My sub-suggestion was including the condition the the new password be "weak" for some definition of weak.

   All the best: Rich Farmbrough, 20:06, 12 November 2015 (UTC).
   

   @Rich Farmbough: Ok, I'll dismiss point one, however point 2 still stands unless the user is creating procedural passwords (ex: CorrectHorseBatteryStaple1, CorrectHorseBatteryStaple2, CorrectHorseBatteryStaple3, etc.) they're going to keep raising the lower limit for password complexity through the "Maybe even then only if it is less strong than their previous password the least strong password you could have would be equal to the current password strength (barring the foundation raising the strength level) as you could never enter a wearker password and users will run into a race condition of causing themselves a very strong password and then never be able to go to a relatively simpler one. Hasteur (talk) 20:50, 12 November 2015 (UTC)

3. Support. All the best: Rich Farmbrough, 19:42, 5 November 2015 (UTC).
   
4. Effective and lets the user decide the risk he or she wants to take. sst✈^discuss 04:50, 6 November 2015 (UTC)
5. Support The more incentives for having a good password, the better. --DSA510 Pls No Bully 05:52, 6 November 2015 (UTC)
6. I can't see how this could hurt, so tentatively supporting, but how much would it help? I can't imagine it would encourage people to use worse passwords. Has this been studied? — Earwig ^talk 09:03, 6 November 2015 (UTC)

   @The Earwig: You may want to see this. Generally, participants in the study tried to make a password that was not "poor." epic genius (talk) 15:31, 6 November 2015 (UTC)

7. Conditional on a competent implementation. MER-C 19:39, 6 November 2015 (UTC)
8. These are becoming standard. I would prefer the bar to be advisory on all but admin and functionary accounts. SilkTork ^{✔Tea time} 11:25, 8 November 2015 (UTC)
9. Pretty much the norm on every website these days, Would really make sense to have one here aswell. –Davey2010^Talk 04:58, 10 November 2015 (UTC)
10. Yes, per my previous comment above.- MrX 16:58, 11 November 2015 (UTC)
11. Great idea and gives users an indication of whether their password is strong or weak. Its only an indicator though.Blethering Scot 21:47, 13 November 2015 (UTC)
12. This would probably reduce the number of users with new weak passwords, even without any enforcement. עוד מישהו Od Mishehu 22:31, 15 November 2015 (UTC)
13. Per above Best proposal here. Should be simple to implement. ---- Patar knight - ^chat/_{contributions} 04:01, 20 November 2015 (UTC)
14. Not intrusive, but would hopefully remind/encourage people to create a strong password. I would support Epicgenius' suggestion of including it in the Preferences option to change your password as well. — Bilorv_(talk)^(c)(e) 17:41, 20 November 2015 (UTC)
15. Support, but the devil is in the details. The strength checker needs to say that "nine out of ten wikipedia editors love jimbo" is strong, "Wikipedia; The Free Encyclopedia That Anyone Can Edit" is weak, "btulvkzhrrmnjgcmqeae" is strong and "6Kx4#Nf!" is weak. --Guy Macon (talk) 22:11, 20 November 2015 (UTC)
16. Support but make it take into account the usual rubbish such as first letter capital, adding 1 on the end, and stuff that's hard to remember and mark these down. Stifle (talk) 10:29, 23 November 2015 (UTC)
17. Support Preferably based on listings most common passwords or proper entropy calculations and not just some silly "Ooooh, a digit, you get a point" sort of sentiment. Written well, this should actually inform people about security, rather than just following arbitrary rules. Happy Squirrel (talk) 20:53, 3 December 2015 (UTC)
18. Chris Troutman (talk) 21:21, 5 December 2015 (UTC)
19. I'm for any feedback indicator in this regard czar 04:27, 7 December 2015 (UTC)

Oppose Add a password strength bar

1. Password strength bars vary between "useless" and "worse than useless" when it comes to creating truly secure passwords. The passwordmeter.com bar, for example, considers "Password1!" to be an example of a strong password. --Carnildo (talk) 02:50, 6 November 2015 (UTC)

   The WMF would not base the password determination technology off passwordmeter.com—that would be copyrighted. The determination of a "secure password" would come about when the 10,000-common-password-list is factored in... or not. (Plus, David Stutz's password bar gives "Password1!" as a red bar, which would then not be accepted under my suggestion.) epic genius (talk) 03:07, 6 November 2015 (UTC)

   I'd recommend zxcvbn (demo), used by Dropbox, Wordpress.com, Splunk and (as I understand it) usually favourably reviewed (disclosure: the author is a coworker). LFaraone 04:24, 30 November 2015 (UTC)

Comment Add a password strength bar

• This bar should also probably be applied to "Change your password" in Special:Preferences as well. epic genius (talk) 19:53, 5 November 2015 (UTC)

Most breaches occur because they are registered on a website that has been breached. If an editor uses the same password for that site or that email/Wikipedia, their account can be compromised without password cracking. The breach tracking website "Have I been pwned?" has an API for mass-checking emails.

Support Email editors if their email address was included in a breach

Oppose Email editors if their email address was included in a breach

• Sadface oppose - unless a special agreement was reached with "Have I been pwned?" this would constitute a breach of privacy, by sending the email addresses to their web site. All the best: Rich Farmbrough, 14:26, 6 November 2015 (UTC).
  

Comment Email editors if their email address was included in a breach

• How would the WMF go about looking for email addresses included in breaches? That is way out of their purview. epic genius (talk) 21:47, 5 November 2015 (UTC)

Log the geolocation of all IPs for 12-24 hours. If the great circle distance (in meters) between the geolocation of a login and the last login looks suspicious for the amount of time that has passed, email the editor to authorize the login. While this measure is less effective for inactive editors, active editors who login frequently would not have their accounts easily breached by hackers halfway across the globe.

Support Detect suspicious logins

1. Sounds useful, at least as an optional feature. An extra feature could be to offer users to disable login or disable certain user rights (such as the right to chang the password) from certain countries. --Stefan2 (talk) 16:53, 16 November 2015 (UTC)
2. Support - provided that this information isn't shared with anyone except the user in question. This can obviously be tested using special testing accounts shared by multiple people at appropriate distances. It should be noted, though, that geolocation isn't perfect, and that such logins may be perfectly legitimate. עוד מישהו Od Mishehu 21:34, 16 November 2015 (UTC)
3. Conditional support Sounds interesting, but it'd just be a nuisance to editors who need to use proxies to edit, me included. It should definitely be optional. Zhaofeng Li [talk ♦ contribs] 11:49, 22 November 2015 (UTC)
4. Support with opt-out. Also, it is important that we not prescribe the precise parameters; maybe the MediaWiki developers find certain values have too many false positives, or decide to apply another threat-scoring mechanism. LFaraone 04:26, 30 November 2015 (UTC)

Oppose Detect suspicious logins

1. Geolocation data is FAR too inaccurate to depend on for this sort of thing. HighInBC 01:44, 22 November 2015 (UTC)

   @HighInBC:We're not talking about blocking an account for being compromised just because there was a login from the wrong part of the world; we're talking about an attempted login from Australia within a few hours of the user in question logging in from Canada - and if the software does nothing but inform the user in question, what harm is done? עוד מישהו Od Mishehu 22:08, 22 November 2015 (UTC)

   A notification would be nice. However the proposal is to "email the editor to authorize the login". This means prevent the login until the user checks their e-mail. The would at the very least need to be a default off option. HighInBC 22:17, 22 November 2015 (UTC)

2. Notifications sound great, particularly when someone instantly travels thousands of miles. But Geo-location isn't reliable enough to justify requiring an email confirmation to login, unless it was an opt-in security feature. Monty₈₄₅ 04:03, 30 November 2015 (UTC)

Comment Detect suspicious logins

I'm concerned about the false-positive rate if this is implemented. I once moved 300 miles just by resetting my router -- my old IP address was correctly geolocated, while the new one geolocated to my ISP's regional headquarters. --Carnildo (talk) 02:38, 17 November 2015 (UTC)

Also request that Global functionaries including these groups have the same requirement.

The group of users with the these flags (currently 32,0 ,1 - locally) and therefore the ability to do some quite nasty stuff.

Note: Currently all local Crats, Stewards and Founders are also admins.

Support Password requirements for 'Crats, Stewards and Founder groups

1. Absolutely. These are the people who can really wreck stuff, mass de-sysop, etc. All the best: Rich Farmbrough, 21:15, 5 November 2015 (UTC).
   
2. For 'crats. — Earwig ^talk 09:03, 6 November 2015 (UTC)
3. For bureaucrats and the founder? Definitely, although this is kinda redundant, per WTT's comment below. However, it can't be placed on stewards unless this is proposed on meta. epic genius (talk) 15:29, 6 November 2015 (UTC)
4. Certainly. JohnCD (talk) 22:25, 6 November 2015 (UTC)
5. Not sure if we can do anything here but if we can then ofcourse!. –Davey2010^Talk 05:01, 10 November 2015 (UTC)
6. Support: I posted below that "A 16 byte password is not necessary for someone who'll create an account, edit a couple of times, and then forget about Wikipedia [or the editing side of it] completely." Targeting only those with the power to do a lot of damage will avoid any disadvantages from enforcing strict requirements. — Bilorv_(talk)^(c)(e) 17:41, 20 November 2015 (UTC)
7. Support: A sensible place to start, even if we later decide to make the requirements universal. --Guy Macon (talk) 22:23, 20 November 2015 (UTC)
8. Support. Yann (talk) 10:31, 30 November 2015 (UTC)
9. Chris Troutman (talk) 21:21, 5 December 2015 (UTC)

Oppose Password requirements for 'Crats, Stewards and Founder groups

Comments Password requirements for 'Crats, Stewards and Founder groups

1. Stewards are a global group, so I don't think we can decide this here, and surely we don't need to set unique password restrictions on Jimbo (given he's already a functionary)? — Earwig ^talk 09:03, 6 November 2015 (UTC)
   • You are right of course that he currently has those bits. It is not beyond the realms of possibility that he might surrender them, he has surrendered most of his super-powers over the years, at least in name. It is obscure what rights come with the Founder bit, it would seem worth including it. All the best: Rich Farmbrough, 14:30, 6 November 2015 (UTC).
     
2. There are no crats or founders that are not admins. I'd prefer we just point it at that group. Worm^TT(talk) 14:33, 6 November 2015 (UTC)

This one doesn't really make any sense as we cannot dictate global policy from here, and only global policy can dictate what stewards (and probably Jimmy as well) must do. Beeblebrox (talk) 20:01, 8 December 2015 (UTC)

Without wishing to appear rude, I'll point out that an RfC is a request for comments, not a vote to decide on implementation. It seems to me that if this needs to be raised at a more global venue - presumably meta - there would still be value in obtaining comments from the English Wikipedia as that would help inform the debate elsewhere. FWIW I think there is value in encouraging/educating most users with advanced permissions to use an unique strong password or passphrase, but I don't think that compulsion is the best means of getting volunteers to comply. --RexxS (talk) 00:16, 9 December 2015 (UTC)

The group of users who have access to non-public data (less than 100) i.e. those with WP:Checkuser or WP:Oversight user-rights - Wikipedia:Functionaries

Support Password requirements for Functionary group

1. Definitely Worm^TT(talk) 10:47, 5 November 2015 (UTC)
2. Absolutely. Callanecc (talk • contribs • logs) 11:14, 5 November 2015 (UTC)
3. At a minimum, something should be applied. --kelapstick^(bainuu) 11:52, 5 November 2015 (UTC)
4. Definitely. Sam Walton (talk) 12:09, 5 November 2015 (UTC)
5. The damage that could be done is quite significant so something needs to be put in place.— Preceding unsigned comment added by Amortias (talk • contribs) 12:29, 5 November 2015
6. With access to the most sensitive data, a stronger password is required. Elockid ^{Message me} 13:12, 5 November 2015 (UTC)
7. Can't be anything wrong with letting rogue functionaries steal all these data. :p epic genius (talk) 14:22, 5 November 2015 (UTC)
8. Yes Hasteur (talk) 15:59, 5 November 2015 (UTC)
9. Certainly.--Ymblanter (talk) 17:52, 5 November 2015 (UTC)
10. Agree. BMK (talk) 18:31, 5 November 2015 (UTC)
11. After the discussion we had on the functuionaries mailing list since this incident unfolded, I think it is safe to say that this scared the crap out of us and nobody feels that it would be a burden to comply with any reasonable new requirements. Beeblebrox (talk) 18:56, 5 November 2015 (UTC)
12. This is essential. BethNaught (talk) 19:24, 5 November 2015 (UTC)
13. Absolutely. Anyone who fails should be de-functionaried today and for ever as having total lack of clue. All the best: Rich Farmbrough, 20:28, 5 November 2015 (UTC).
    
14. Support The stronger the better, especially considering that these accounts have access to such sensitive data. --DSA510 Pls No Bully 05:55, 6 November 2015 (UTC)
15. Of course. — Earwig ^talk 09:03, 6 November 2015 (UTC)
16. Obviously. MER-C 17:50, 6 November 2015 (UTC)
17. Absolutely. JohnCD (talk) 22:25, 6 November 2015 (UTC)
18. Mkdw^talk 22:22, 7 November 2015 (UTC)
19. Support, certainly. — xaosflux ^Talk 15:48, 8 November 2015 (UTC)
20. As these accounts work with sensitive stuff & whatnot it only makes sense to have a much better password. –Davey2010^Talk 05:03, 10 November 2015 (UTC)
21. Yes, this would seem to be an obvious necessity. ​—DoRD (talk)​ 01:13, 11 November 2015 (UTC)
22. Yes. Ideally this group would be required to use two factor authentication, but the proposal is better that the current scheme. - MrX 17:21, 11 November 2015 (UTC)
23. No-brainer. —zziccardi (talk) 02:37, 16 November 2015 (UTC)
24. Per above Obvious first step. ---- Patar knight - ^chat/_{contributions} 04:01, 20 November 2015 (UTC)
25. Support: I posted below that "A 16 byte password is not necessary for someone who'll create an account, edit a couple of times, and then forget about Wikipedia [or the editing side of it] completely." Targeting only those with the power to do a lot of damage will avoid any disadvantages from enforcing strict requirements. — Bilorv_(talk)^(c)(e) 17:41, 20 November 2015 (UTC)
26. Support: A sensible place to start, even if we later decide to make the requirements universal. --Guy Macon (talk) 22:23, 20 November 2015 (UTC)
27. Support: As a functionary, I totally agree that those accounts security should be held to a high standard. LFaraone 04:27, 30 November 2015 (UTC)
28. Support Yann (talk) 10:32, 30 November 2015 (UTC)
29. Support These people are trusted with access to data that could expose people to harm. Outing is a big concern. Happy Squirrel (talk) 20:59, 3 December 2015 (UTC)
30. Chris Troutman (talk) 21:21, 5 December 2015 (UTC)

Oppose Password requirements for Functionary group

The group of users with the sysop flag (currently 862) and therefore the ability to see deleted data - Wikipedia:Administrators

Support Password requirements for Administrator group

1. Definitely Worm^TT(talk) 10:47, 5 November 2015 (UTC)
2. kelapstick^(bainuu) 11:55, 5 November 2015 (UTC)
3. Not as vitally important as functionaries, but still worth higher security. Sam Walton (talk) 12:09, 5 November 2015 (UTC)
4. Per Samwalton9. Amortias (T)(C) 12:30, 5 November 2015 (UTC)
5. Admins have the ability to cause site wide damage. Also, there is likely still deleted data that can be sensitive of nature, some of which could have been qualified to be suppressed but have not yet been reported. A strong password is needed. Elockid ^{Message me} 13:15, 5 November 2015 (UTC)
6. The accounts breached are admins, it makes sense to require strong passwords for all admins. sst✈^discuss 13:45, 5 November 2015 (UTC)
7. There is the same vulnerability with rogue admins as with functionaries. epic genius (talk) 14:23, 5 November 2015 (UTC)
8. I would say so, the risk is too high--Ymblanter (talk) 17:52, 5 November 2015 (UTC)
9. Agree. BMK (talk) 18:32, 5 November 2015 (UTC)
10. It is a shame that some folks who are apparently ok as admins were pretty foolish about their passwords. One of them apparently used their date of birth. At the very least there should be some firm advice ont his, but an actual rule would be more effective. Beeblebrox (talk) 18:58, 5 November 2015 (UTC)
11. Since not all admins can apparently be trusted to maintain adequate security practices. BethNaught (talk) 19:24, 5 November 2015 (UTC)

    This only covers one aspect of good security practices. All the best: Rich Farmbrough, 20:29, 5 November 2015 (UTC).
    

12. Despite my caveats above on some of the proposed requirements, I support this. Any admin who does not understand the need for a good password will benefit from the education. All the best: Rich Farmbrough, 20:31, 5 November 2015 (UTC).
    
13. Of course. — Earwig ^talk 09:03, 6 November 2015 (UTC)
14. Given that you can spread malware with administrator access, this is a necessity (it will be reverted quickly but the reputation damage will be immense). MER-C 17:52, 6 November 2015 (UTC)
15. Certainly. JohnCD (talk) 22:26, 6 November 2015 (UTC)
16. Mkdw^talk 22:22, 7 November 2015 (UTC)
17. Support. — xaosflux ^Talk 15:46, 8 November 2015 (UTC)
18. Ofcourse!. –Davey2010^Talk 05:04, 10 November 2015 (UTC)
19. This also seems to be a necessary step to take. ​—DoRD (talk)​ 01:14, 11 November 2015 (UTC)
20. Yes. - MrX 17:22, 11 November 2015 (UTC)
21. Absolutely. —zziccardi (talk) 02:39, 16 November 2015 (UTC)
22. Per above Obvious second step. ---- Patar knight - ^chat/_{contributions} 04:01, 20 November 2015 (UTC)
23. Support: I posted below that "A 16 byte password is not necessary for someone who'll create an account, edit a couple of times, and then forget about Wikipedia [or the editing side of it] completely." Targeting only those with the power to do a lot of damage will avoid any disadvantages from enforcing strict requirements. — Bilorv_(talk)^(c)(e) 17:41, 20 November 2015 (UTC)
24. Support: A sensible place to start, even if we later decide to make the requirements universal. --Guy Macon (talk) 22:23, 20 November 2015 (UTC)
25. Support Yann (talk) 10:32, 30 November 2015 (UTC)
26. Chris Troutman (talk) 21:21, 5 December 2015 (UTC)

Oppose Password requirements for Administrator group

1. admins have no rights that can compromise anything in the function of WP. So raised limits for their (our) passwords are irrelevant. --h-stt !? 14:23, 24 November 2015 (UTC)

This is incorrect - Admins have the ability to edit site javascript (As well as personal javascript of any individual user). Someone who knows what they are doing could use this to take over any arbitrary account or extract potentially personally identifying information from any user, or just break the site totally. Bawolff (talk) 00:22, 1 December 2015 (UTC)

Comments Password requirements for Administrator group

• What about for admins who have been inactive but don't have email? How should we reset their passwords, let alone notify them about it? epic genius (talk) 20:35, 5 November 2015 (UTC)

  How many of them are there? (There might be none.) And I think the process is that the system insists you change your password as part of the log-in procedure, so there is still a window of opportunity to compromise those accounts, however reducing the number of (potential) admin accounts with weak(ish) passwords is good work. It reduces the cross-section of the attack. All the best: Rich Farmbrough, 21:11, 5 November 2015 (UTC).
  

  I expect their passwords would become invalid when they next try to log in with them. If they're inactive, then it doesn't get reset. Worm^TT(talk) 08:36, 6 November 2015 (UTC)

The group of users with the EFM flag (currently 170) and therefore the ability to break the wiki.

Support Password requirements for Edit Filter Manager group

1. It's no more dangerous than an admin account - since they have access to the functionality by granting it to themselves. But aside from the privacy issues of seeing deleted stuffs, this is one of the operationally most potent bits there is. All the best: Rich Farmbrough, 21:06, 5 November 2015 (UTC).
   
2. Edit filter managers could create malicious edit filters if the accounts are hijacked; some of these edit filters could potentially automatically prevent users from editing articles, just as admins could. epic genius (talk) 21:18, 5 November 2015 (UTC)
3. This is another group I'd support any requirements being applied to. Worm^TT(talk) 08:32, 6 November 2015 (UTC)
4. EFMs are effectively mini-admins. Given that it involves a certain amount of private data (not a whole lot, but private filters can be exploited), I tentatively agree. — Earwig ^talk 09:03, 6 November 2015 (UTC)
5. Support, as this group can be granted ad-hoc, and can be disruptive to large number of editors. — xaosflux ^Talk 15:47, 8 November 2015 (UTC)
6. Per above Obvious third step. ---- Patar knight - ^chat/_{contributions} 04:01, 20 November 2015 (UTC)
7. Support: I posted below that "A 16 byte password is not necessary for someone who'll create an account, edit a couple of times, and then forget about Wikipedia [or the editing side of it] completely." Targeting only those with the power to do a lot of damage will avoid any disadvantages from enforcing strict requirements. — Bilorv_(talk)^(c)(e) 17:41, 20 November 2015 (UTC)
8. Support: A sensible place to start, even if we later decide to make the requirements universal. --Guy Macon (talk) 22:23, 20 November 2015 (UTC)
9. Support Yann (talk) 10:33, 30 November 2015 (UTC)
10. Chris Troutman (talk) 21:21, 5 December 2015 (UTC)

Oppose Password requirements for Edit Filter Manager group

Comments Password requirements for Edit Filter Manager group

1. The argument I post above does not fully convince me. (Even really bad actions can be undone quickly, and EFMs are as blockable as anyone.) But the burden is pretty light, and the number of EFMs that are not Admins is very small. All the best: Rich Farmbrough, 21:06, 5 November 2015 (UTC).
   

The group of users with the Template Editor flag (currently 118) and therefore the ability to do some quite nasty stuff.

Support Password requirements for Template Editor group

Oppose Password requirements for Template Editor group

1. Yes, there is vandalism leverage, but it is subject to reverts, and blocks. All the best: Rich Farmbrough, 21:01, 5 November 2015 (UTC).
   
2. Can they vandalize? Yes. Can it cause people to be prevented from editing a page, like a rogue admin or edit filter manager could? No. epic genius (talk) 21:19, 5 November 2015 (UTC)
3. No private data involved; I don't see a strong reason. — Earwig ^talk 09:03, 6 November 2015 (UTC)
4. No point as any template edits can be reverted and the compromised account blocked. –Davey2010^Talk 05:06, 10 November 2015 (UTC)
5. Per above Easily fixed if compromised and without much ramifications. ---- Patar knight - ^chat/_{contributions} 04:01, 20 November 2015 (UTC)
6. Chris Troutman (talk) 21:21, 5 December 2015 (UTC)

Comments Password requirements for Template Editor group

The group of users with access to AWB and therefore the ability to quickly make large numbers of repetitive edits - Wikipedia:AutoWikiBrowser

Support Password requirements for users with AutoWikiBrowser access

1. An account with AWB access can, for example, redirect articles to pages like Fellatio or Gay Nigger Association of America, at a rate of over 50 edits a minute. This can cause quite a bit of disruption. sst✈^discuss 14:06, 5 November 2015 (UTC)
2. Chris Troutman (talk) 21:21, 5 December 2015 (UTC)

Oppose Password requirements for users with AutoWikiBrowser access

1. Difficult as AWB access is not a user-right, but a tool with a list of users who can use the tool. If that sort of disruption was intended there are other ways to do it. Worm^TT(talk) 14:09, 5 November 2015 (UTC)
2. Not only is this not a user right (so the WMF cannot enforce this), but AWB access isn't as disruptive as admin access. A quick quick quick quick block of errant AWB users, and an instant rollback, should do the trick. Generally, though, I would support minimum password requirements for people with advanced user rights, like rollback, template editor, abuse filter manager, or account creator (and maybe even mass message sender). epic genius (talk) 14:28, 5 November 2015 (UTC)
3. AWB is a tool, not a user group. They have already managed to shoehorn WP:PERM admins into being part of their screening process by requiring rollback first. I don't think this is appropriate. Beeblebrox (talk) 19:00, 5 November 2015 (UTC)
4. Per others. BethNaught (talk) 19:24, 5 November 2015 (UTC)
5. Oppose Because <pre-redacted per WP:BEANS> this does nothing special for security. All the best: Rich Farmbrough, 19:44, 5 November 2015 (UTC).
   
6. No reason why AWB should be special. Plus, this makes what is currently a fairly simple approvals process a lot more complicated, and if someone cared enough to try to compromise an AWB account, it'd be much simpler to just run a bot with the API. — Earwig ^talk 09:03, 6 November 2015 (UTC)
7. Oppose, this should be the same as any other user account requirements. — xaosflux ^Talk 15:48, 8 November 2015 (UTC)
8. No point as any AWB edits can be reverted and the account can be blocked. –Davey2010^Talk 05:08, 10 November 2015 (UTC)
9. Per above Easily fixed if compromised and without much ramifications. ---- Patar knight - ^chat/_{contributions} 04:01, 20 November 2015 (UTC)
10. No. I am perfectly capable of writing a program that does what AWB does. Automated edits may be a problem, but this is the wrong solution. --Guy Macon (talk) 22:23, 20 November 2015 (UTC)

Comments Password requirements for users with AutoWikiBrowser access

• I think we should treat the assortment of non-functionary non-admin user rights or accesses under the umbrella of 'all users'. There are simply too many of these (ACC,Template Editor, AfC reviewer, etc.) for it to be feasible for us to discuss each one in a different way. Sam Walton (talk) 14:13, 5 November 2015 (UTC)
• This seems out of scope for this RFC since AWB is not MediaWiki. That said, a separate discussion in the context of AWB's pages could plausibly come up with consensus for something similar to this. --Izno (talk) 15:18, 5 November 2015 (UTC)

All users (currently 47,212,168) should follow these password requirements.

Support Password requirements for All users

1. Wikimedia passwords never have to be changed, so there's no harm in forcing a complex password. If the password has a 90 day expiry (for example) that's a different matter as people will start writing them down. QuiteUnusual (talk) 11:04, 5 November 2015 (UTC)

   My understanding from the WMF Security team member is that if you try to log in with a password which does not meet the requirement, you will be forced to change it. Worm^TT(talk) 11:12, 5 November 2015 (UTC)

   The password still has to be remembered (or recorded some other way). All the best: Rich Farmbrough, 20:36, 5 November 2015 (UTC).
   

Oppose Password requirements for All users

1. I think that forcing all users to conform to these new requirement is probably overkill. Worm^TT(talk) 10:47, 5 November 2015 (UTC)
2. At this stage I'm sitting here, although there may be other usergroups which should have these password requested implemented (template editor and edit filter managers are the big one I can think of). Callanecc (talk • contribs • logs) 11:11, 5 November 2015 (UTC)
3. I don't think this is necessary. --kelapstick^(bainuu) 11:54, 5 November 2015 (UTC)
4. Would hurt editor retention. sst✈^discuss 13:44, 5 November 2015 (UTC)
5. Given that it's easier to create an account than to crack a password, this would do virtually nothing to promote site security, but will annoy/inconvenience thousands upon thousands of editors. The Big Bad Wolfowitz (aka Hullaballoo) (talk) 13:52, 5 November 2015 (UTC)
6. The vast majority of registered users don't make more than a couple edits with an account. Why affect them if they are not going to log into their accounts anyway? Also, this is not an incentive for editors. epic genius (talk) 15:36, 5 November 2015 (UTC)
7. Strongly – a number of us aren't interest in Admin'ing precisely because we don't want to have deal with stuff like this. Also, if a "regular" account gets compromised, it shouldn't be too big an issue for Admins to shut down any resulting malarkey quickly. --IJBall (contribs • talk) 17:18, 5 November 2015 (UTC)
8. Users who do not have access to sensitive data should decide themselves whether risk to have their account broken is sufficient.--Ymblanter (talk) 17:54, 5 November 2015 (UTC)
9. There's no increased security for Wikipedia in this. BMK (talk) 18:29, 5 November 2015 (UTC)
10. We don't want to make it harder to get started. Increased standards for users with advanced perissions is one thing, forcing it on every single account is a bit much. Beeblebrox (talk) 19:02, 5 November 2015 (UTC)
11. Not necessary for Wikipedia's security. Will deter sign-ups. BethNaught (talk) 19:24, 5 November 2015 (UTC)
12. Users are responsible for their own security. We want them to remember their password when they make a second edit 6 months later. Let them make the judgement call. All the best: Rich Farmbrough, 20:36, 5 November 2015 (UTC).
    
13. No strong reason for this in general. — Earwig ^talk 09:03, 6 November 2015 (UTC)
14. Not necessary. JohnCD (talk) 22:26, 6 November 2015 (UTC)
15. Considering that "anyone can edit" without even needing an account, and that there's very little an established account can do that a new 10-edit 4-day account can't, there doesn't really seem to be any security to protect. 823510731 (talk) 17:43, 7 November 2015 (UTC)
16. This would discourage registration and possibly editing altogether. Reach Out to the Truth 18:14, 7 November 2015 (UTC)
17. I worry this would complicate the process of editing and steer writers away from the project, especially those without strong computer skills. Mkdw^talk 22:25, 7 November 2015 (UTC)
18. To be honest I'm on the fence with this but all in all I guess again Commonsense should prevail - You should pick a good password & all that, If an account does get hacked the worst they can do is vandalize an article for about 10 minutes before getting blocked and as noted above some editors only sign up and don't edit once so again I guess kinda pointless & unnecessary. –Davey2010^Talk 05:14, 10 November 2015 (UTC)
19. I would only consider this if IP editors were required to register for an account.- MrX 17:24, 11 November 2015 (UTC)
20. Per above Overkill. ---- Patar knight - ^chat/_{contributions} 04:01, 20 November 2015 (UTC)
21. A 16 byte password is not necessary for someone who'll create an account, edit a couple of times, and then forget about Wikipedia [or the editing side of it] completely. When we have the amazing technical ability to restrict password checks to those with enough rights to do any widespread damage, I don't understand why we would choose instead to make everybody follow strict rules. Most accounts have nothing worth hacking into for. — Bilorv_(talk)^(c)(e) 17:41, 20 November 2015 (UTC)
22. I think we need some lightweight requirements for ordinary editors and heavyweight requirement for anyone with the power to do hard-to-undo harm. --Guy Macon (talk) 22:23, 20 November 2015 (UTC)
23. Overkill. Regular accounts without teh bits don't threaten the wiki quite to the degree as other user groups. Chris Troutman (talk) 21:21, 5 December 2015 (UTC)

Comment Password requirements for All users

• Not sure on this one yet, waiting to hear what other users have to say. Sam Walton (talk) 12:10, 5 November 2015 (UTC)
• The damage that can be caused is minimal and only slightly more than what could be caused by an IP. Some users with additional rights might need this template editors ACC accounts as the damage that could be done by screwing with a protected template may be significant. Amortias (T)(C) 12:32, 5 November 2015 (UTC)

  Yes I'd add EFM and maybe TE. All the best: Rich Farmbrough, 20:36, 5 November 2015 (UTC).
  

1. Requiring long, hard to remember passwords would do more harm than good. A lot of strong contributors start out by making a marginal number of edits from time to time before becoming more engaged, and I'm worried that many such editors may be turned off entirely if they can never remember their password. Also, only a few thousand accounts have any permission beyond autoconfirmed (which is easily obtained), so a person who compromises a run-of-the-mill account is not going to be able to do much more damage to Wikipedia beyond what they could do if they directly created a vandal account. Spirit of Eagle (talk) 02:38, 7 November 2015 (UTC)

• In an office I once worked at, the IT department decided to enforce strong password requirements with 90-day expiry periods. During an audit approximately six months later, they were aghast to discover that about 20% of the office staff had written down their passwords and put them in not-very-safe locations (like on post-it notes on their monitors, or in unlocked desk drawers). External software (like password keepers) was not permitted unless approved by the IT department (and they never approved anything that wasn't mandated by corporate management). Prior to the change, nobody had been known to keep their passwords in unsafe locations like this, so the change actually reduced the overall security of the system, although I don't believe there was a breech because of it. FYI this was a minor office of a major company that is known worldwide.Etamni | ✉ | ✓  13:49, 6 December 2015 (UTC)

Regular audits for the group of users who have access to non-public data (less than 100) i.e. those with WP:Checkuser or WP:Oversight user-rights - Wikipedia:Functionaries

Support Regular audits for Functionary group

1. Definitely. Worm^TT(talk) 10:47, 5 November 2015 (UTC)
2. Support. QuiteUnusual (talk) 11:04, 5 November 2015 (UTC)
3. Absolutely. Elockid ^{Message me} 13:08, 5 November 2015 (UTC)
4. Support this idea. In addition, force a password reset every once in a while. epic genius (talk) 15:39, 5 November 2015 (UTC)
5. With details to be figured out.--Ymblanter (talk) 17:55, 5 November 2015 (UTC)
6. Agree. BMK (talk) 18:33, 5 November 2015 (UTC)
7. Essential. BethNaught (talk) 19:24, 5 November 2015 (UTC)
8. Obviously yes. --DSA510 Pls No Bully 05:58, 6 November 2015 (UTC)
9. In some form, yes. — Earwig ^talk 09:03, 6 November 2015 (UTC)
10. Buy a bunch of GPUs, install Hashcat and set it loose. MER-C 17:53, 6 November 2015 (UTC)
11. Absolutely!. –Davey2010^Talk 05:15, 10 November 2015 (UTC)
12. I support the idea behind this, as long as it doesn't create additional potential data breaches. ​—DoRD (talk)​ 01:18, 11 November 2015 (UTC)
13. I support completely. Stuartyeates (talk) 21:36, 15 November 2015 (UTC)
14. Yep! —zziccardi (talk) 02:54, 16 November 2015 (UTC)
15. Per above As long as it's in line with our privacy policies and applicable laws ---- Patar knight - ^chat/_{contributions} 04:01, 20 November 2015 (UTC)
16. Support as long as the audit is done by trusted WMF employees without exposing sensitive data. Zhaofeng Li [talk ♦ contribs] 11:39, 22 November 2015 (UTC)
17. Support Yann (talk) 10:34, 30 November 2015 (UTC)
18. Chris Troutman (talk) 21:21, 5 December 2015 (UTC)

Oppose Regular audits for Functionary group

1. This is not actually an oppose. It's request to think this through, and maybe re-word it. What is to be audited? (Ideally it would be the use of the tools but I doubt that would gain traction!) I suspect the proposer means the nominal password strength. (Nominal because, for example, I happen to know Dave's password is "WTTDoomBar4%" which counts as "secure" but isn't.) The passwords are not available until an attempted login in made. At that point any action taken with the password risks leaving a footprint. SOP is to encrypt it and overwrite the memory space that contained the unencrypted variable. All the best: Rich Farmbrough, 19:53, 5 November 2015 (UTC).
   

   I was presuming that it meant a request for the WMF to compare its list of password hashes against hashes of publicly known passwords. It is not necessary to attempt to brute-force entry; that could be done but would be less efficient than a server-side cracking attempt. BethNaught (talk) 19:55, 5 November 2015 (UTC)

   Beth this is a species of brute-forcing known as a dictionary attack. Depending on the number of bits of salt (again nominally the obvious meaning of bits) one requires a proportionally larger or smaller dictionary. The standard used to be, I think 4096 possible salts, which is 12 bits. (It is trivial to modify the crypt to use many more bits - and something many unix sites used to do - or indeed to add a few extra rounds of the encryption function.)

   The way to do this, if it is decided to do it, is with a clean machine, loaded with the necessary tools and the password/shadow files, in a clean room, off any network. The results are printed and scanned (or typed - hopefully there won't be many accounts) and the machine wiped completely (and recycled as fire-lighters).

   All the best: Rich Farmbrough, 20:46, 5 November 2015 (UTC).
   

   @Rich Farmbrough: The audits would be of the form of regularly checking if email address were included in a breach, and possibly against lists of common passwords. Checking for nominal password strength hasn't been mentioned. Worm^TT(talk) 08:30, 6 November 2015 (UTC)

   Thanks for the clarification. You say "hasn't been mentioned" - as if there was a discussion elsewhere? All the best: Rich Farmbrough, 14:33, 6 November 2015 (UTC).
   

   If I wasn't clear, I went searching for someone in the WMF who might help with these issues in light of compromised admin accounts. When I found someone, I had a quick discussion and then brought some suggestions here for the "quick wins". So, when I say "hasn't been mentioned" I meant in the conversations with the Security Team staff member. I fully intend to carry on pushing for better security after this RfC Worm^TT(talk) 14:40, 6 November 2015 (UTC)

   BethNaugh: I don't think comparing hashes is particularly useful. I don't know what wikimedia uses, but many of the public hashes would be some other hash. You need to generate your own hashes from a list of passwords as Rich Farmbrough mentioned. Nil Einne (talk) 23:19, 12 November 2015 (UTC)

• I do not see how this can be reliably done without breaching the privacy policy. Might be justifiable for checkuser/oversighter (these groups do have access to information that is covered under the privacy policies), but I can't see it for admin accounts. Believe it or not, Wikipedia administrator accounts aren't all that valuable. Risker (talk) 06:00, 7 November 2015 (UTC)

1. I don't think it's a good idea to regularly expose the encrypted hash/password file. Once the encrypted table is leaked, it can be cracked. the best method is to leave it alone and track access. "ypcat passwd" should return "*" in the password field and that was done for that very reason. In addition, having strict policy on access reduces the "I thought running crack on the password file was part of my job for security." Too many chefs means that he password file will get out even if encrypted. --DHeyward (talk) 23:38, 10 November 2015 (UTC)

Regular audits for the group of users with the sysop flag (currently 862) and therefore the ability to see deleted data - Wikipedia:Administrators

Support Regular audits for Administrator group

1. Definitely. Worm^TT(talk) 10:47, 5 November 2015 (UTC)
2. Support. QuiteUnusual (talk) 11:04, 5 November 2015 (UTC)
3. Strong support. But this should be expanded to require ALL admins to have an email address set. Elockid ^{Message me} 13:10, 5 November 2015 (UTC)

   Inclined to support the "email" part. It seems a minor requirement. Note that having an email set does not mean that "email this user" is necessarily enabled.

   However remember that the email account is a second point of attack. If this is compromised the Wikipedia account is wide open.

   All the best: Rich Farmbrough, 20:52, 5 November 2015 (UTC).
   

4. Support this idea. In addition, force a password reset every once in a while. epic genius (talk) 15:39, 5 November 2015 (UTC)
5. With details to be figured out.--Ymblanter (talk) 17:55, 5 November 2015 (UTC)
6. Agree. BMK (talk) 18:33, 5 November 2015 (UTC)
7. Would be good practice. Password resets should not be mandated though, in all likelihood a similar password to before would be chosen. BethNaught (talk) 19:24, 5 November 2015 (UTC)
8. As above. — Earwig ^talk 09:03, 6 November 2015 (UTC)
9. As above. MER-C 17:54, 6 November 2015 (UTC)
10. Anyone unwilling to associate their account with an email address should not be given any form of elevated privileges. Period.  — Scott • talk 15:57, 8 November 2015 (UTC)
11. Absolutely!. –Davey2010^Talk 05:16, 10 November 2015 (UTC)
12. As above. ​—DoRD (talk)​ 01:19, 11 November 2015 (UTC)
13. I support completely. Stuartyeates (talk) 21:36, 15 November 2015 (UTC)
14. Absolutely, and I agree with Elockid and Scott. —zziccardi (talk) 02:58, 16 November 2015 (UTC)
15. Per above As long as it complies with our policies and any applicable laws. ---- Patar knight - ^chat/_{contributions} 04:01, 20 November 2015 (UTC)
16. Of course audit at my old work you could get fired if the audit team could guess your password. HighInBC 01:48, 22 November 2015 (UTC)
17. Support as long as the audit is done by trusted WMF employees without exposing sensitive data. Zhaofeng Li [talk ♦ contribs] 11:39, 22 November 2015 (UTC)
18. Support Yann (talk) 10:34, 30 November 2015 (UTC)
19. Chris Troutman (talk) 21:21, 5 December 2015 (UTC)

Oppose Regular audits for Administrator group

1. See above. All the best: Rich Farmbrough, 19:53, 5 November 2015 (UTC).
   
2. Not if it gives someone access to the encrypted password file. No one should be running crack on it. No one should be able to access it without a log and no one should be able to download it to any media. Should be fireable offense. --DHeyward (talk) 23:29, 10 November 2015 (UTC)

   No, we should make the encrypted password file publicly available and invite any and all comers to try to crack it, with a nice page where they can report which ones they cracked and a list showing who cracked and reported the most. In short order, we will have 100% uncrackable passwords. (We might want to try some common cracking dictionaries ourselves first to weed out some of the really easy ones, and not give points for brand new passwords so nobody starts "cracking" passwords they themselves entered). If someone is really good at this, the WMF might want to hire them. See Kerckhoffs's principle and Security through obscurity. --Guy Macon (talk) 00:41, 22 November 2015 (UTC)

   This is simply asking for trouble. I don't mind if WMF staffers run the audit regularly under a NDA, but disclosing it publicly is certainly going to do more harm than good. Zhaofeng Li [talk ♦ contribs] 11:37, 22 November 2015 (UTC)

   Standards bodies such as the National Institute of Standards and Technology (NIST) strongly disagree with you and specifically recommend against the practice you are advocating: "System security should not depend on the secrecy of the implementation or its components." --Guy Macon (talk) 19:18, 22 November 2015 (UTC)

   I've never heard Kerckhoffs's principle be construed to mean that you should publicize password hashes. It means we should be public about the algorithm used to hash passwords, and how we're protecting them (Which we are). Bawolff (talk) 20:02, 22 November 2015 (UTC)

   It is a basic principle that applies to everything security related. "Do not rely upon anything other than your passphrases staying secret". Right now, nobody working for the WMF has any way of knowing what passwords Bawolff or Guy Macon use to log on to Wikipedia. Even an attacker who can read any file can not find out that information. Getting the hashed password file, on the other hand, can be done. Offer a bribe or make a credible threat to the right person. Exploit a zero-day bug somewhere in the millions of lines of operating system code and obtain root access, even if you are discovered and locked out after a few minutes. You cannot stop a determined attacker from obtaining the hashed password file, so don't even try. Design a system that is secure even if an attacker knows every detail about your system (which he will if he cares enough to bribe or threaten the right person) it is still secure, and verify your security be letting all potential attackers -- and your friends who may very well catch any vulnerabilities first and alert you -- know everything about your system. This is the same principle behind open-source software being more secure than proprietary software, and the counterarguments against it are the same. Shannon's Maxim: "The enemy knows the system". --Guy Macon (talk) 23:32, 22 November 2015 (UTC)

   "Even an attacker who can read any file can not find out that information" <-- What about the file /dev/mem ;). There's several reasons we want to keep hashes secret. Keeping them secret allows us to detect when someone is trying to bruteforce someone's passwords (via server logs), it allows us to change the hashing algorithm as advances are made in terms of speeds of computers (Sure, it may be infeasible now to brute force someone's password hash, but what about 10 years from now?). Additionally, in the face of users choosing stupid passwords (Which at the end of the day, is pretty hard to stop), having proper hashing/salting more slows down an attacker, rather then stops them. Bawolff (talk) 22:30, 23 November 2015 (UTC)

   There are always multiple "good reasons" for using Security through obscurity techniques such as you describe, and there are many different security through obscurity techniques, leaving the critic of such techniques in the position of playing Whac-A-Mole. There is only one "good reason" not to use security through obscurity techniques, but it is a big one: using security through obscurity techniques reduces security. --Guy Macon (talk) 09:21, 7 December 2015 (UTC)

   Naturally we want to keep the hashes secret, but security in depth requires preparation for the time when they are inadvertently revealed. I don't know the current status but how the password hashes should be secured has been investigated. See 2010-08-23 and the proposal that it points to. Ooops, I didn't read all the comments above. Some of us want the hashes to be secret! While publishing all the hashes would be courageous, the catastrophic harm that could result means it won't be tried. Johnuniq (talk) 10:00, 7 December 2015 (UTC)

   Agree that it won't be tried (and I would not waste anyone's time proposing something that I know will not pass) but I would like to emphasize that the exact same same argument is used to support all of the other security through obscurity techniques used on other sites/systems. Revealing the algorithm used to hash passwords could result in catastrophic harm. Publishing our source code could result in catastrophic harm. Allowing us to talk about security flaws on this very page could result in catastrophic harm. These are all simply variation of the basic security through obscurity technique, and they all reduce security. The reason that they all reduce security is because of basic human nature. If we attempt to keep our hashes secret (which only works if the underlying operating system has no flaws that would allow an attacker root access and every WMF employee who has root access is immune to bribes and threats), it is basic human nature that less effort will go into making our system secure even against an attacker who has access to the hashes. It also means that the only people who will be able to test our hashes for subtle or obvious flaws are WMF employees who have access to he hashes. If, on the other hand, we publish the hashes, then many people will test them for exploitable flaws, and a lot of those testers will report any flaws to WMF or at the very least publish them on the internet. I realize that some here really believe that some or all security through obscurity techniques increase security, but it is the considered opinion of the top experts in the field that all security through obscurity techniques decrease security. As I have pointed out before, an RfC is the wrong answer here. Complex technical problems with counter-intuitive technical solutions should not be voted on by a collection of a few experts and a large number of non-experts. --Guy Macon (talk) 17:07, 7 December 2015 (UTC)

   To answer Johnuniq's question: The current state is: Most passwords are hashed using the PBKDF2-sha256 algorithm with a cost of 64000, and a 128-bit salt (Basically, that's hashing using sha256 hmac 64,000 times). Some users who haven't logged in in a long time don't have their password converted to the new format. This is on the to-do list to fix. We currently do not pepper our passwords. This is also something that we will probably fix in the future. To respond to Guy - I doubt we're going to agree on this, but the reason I believe password hashes should be secret, is that they are essentially "keys". Traditionally any keys in a crypto system are kept secret. Bawolff (talk) 22:40, 7 December 2015 (UTC)

   @Bawolff: Thanks for info. That strategy, combined with the fact that inactive admins are desysopped after 12 months, should mean that everyone with advanced permissions has a well-secured hash, I suppose (I think MediaWiki 1.24 with the feature has been at enwiki for just over a year). Johnuniq (talk) 23:07, 7 December 2015 (UTC)