Just realized the consecutive character count description in the interface is not how it actually works. It states:

Consecutive character count: Password cannot have more than this number of identical consecutive characters

So for example, let's say I set the consecutive character count to 3. Based on the description above, I would expect that "222" or "bbb" in a password would be acceptable.

However, in the user experience, I see the following message when I type in "222":

"Password cannot have 3 consecutive letters."

Therefore the wording in the administrative page does not match how it functions. I would recommend that the following changes should be made in the admin screens:

In vertical tab:

No more than X consecutive characters --> Less than X consecutive characters

On tab content:

Password cannot have more than this number of identical consecutive characters -->
Password must have less than this number of identical consecutive characters

As a side note, I really think this should be modified to be "up to and including" the value entered, but I'm offering a solution that doesn't change the underlying functionality.

If you'd like to take that step, I'd certainly be in support of it.

CommentFileSizeAuthor
#8 password_policy-7.x-2.x-character_count_description-2499341-8.patch1.86 KBaohrvetpv
#4 password_policy-7.x-2.x-character_count_description-2499341-4.patch1.88 KBaohrvetpv
#2 password_policy-7.x-2.x-character_count_description-2499341-2.patch1.85 KBsgdev

Comments

aohrvetpv’s picture

aohrvetpv commented

Looks correct to me, except grammatically it should be "fewer" not "less", since characters are countable items.

Thanks for reporting the bug. A patch would be welcome, though I can make one later.

"222" is also not 3 consecutive letters, but that is a terminological problem that could be solved separately. I'd guess the author wanted to avoid using the technical term "character".

Edit: Corrected line about grammar.

sgdev’s picture

sgdev commented
StatusFileSize
new password_policy-7.x-2.x-character_count_description-2499341-2.patch1.85 KB

Yes, correct... fewer, not less. And yes, did notice about the letters/numbers/characters terminology too. Made an update for that.

See attached.

sgdev’s picture

sgdev commented
Status: Active » Needs review
aohrvetpv’s picture

aohrvetpv commented
StatusFileSize
new password_policy-7.x-2.x-character_count_description-2499341-4.patch1.88 KB

Changes:

1. Change "letters or numbers" to "letters, numbers, or symbols" for accuracy.

This is still not fully accurate since whitespace characters are not symbols, I think. We could say "letters, numbers, spaces, or symbols". But we could neglect this on the basis that it is very rare for someone to use consecutive spaces within a password.

2. Change "consecutive" to "identical consecutive" in user message.

This seems necessary because "Fewer than X consecutive letters or numbers" could be interpreted to mean "you can't have X different letters in a row". 'abc', for instance, is 3 consecutive letters.

3. Change "consecutive" to "identical consecutive" in summary for consistency.

aohrvetpv’s picture

aohrvetpv commented

"identical consecutive" is perhaps dense wording.

"Passwords must have fewer than X of the same letter, number, or symbol in a row." might be easier for users to understand.

"in a row" is an idiom, though. So another possibility:
"Passwords must have fewer than X of the same letter, number, or symbol consecutively."

sgdev’s picture

sgdev commented

Originally I tried changing "identical consecutive" to several variations:

"matching consecutive"
"consecutive matching"
"consecutively matched"
"matched letters or numbers in a row"
"matched letters or numbers in order"

The reason why I chose none of those is how extremely long the text is getting relative to all the other messages on the registration page. Now by adding "consecutive letters, numbers or symbols" and "identical" it has been made even longer.

Can we be more concise and go with "identical consecutive characters"? I believe shorter is better.

sgdev’s picture

sgdev commented

Or if you prefer "matched consecutive characters" rather than "identical"...

aohrvetpv’s picture

aohrvetpv commented
StatusFileSize
new password_policy-7.x-2.x-character_count_description-2499341-8.patch1.86 KB

OK, this patch changes to "identical consecutive characters" due to concern over user message length. "characters" is most accurate, anyway. Please review.

I have slight reservation about exposing the term "characters" to users because I am not sure all users will know what a "character" is. Maybe I am underestimating how common the term is.

sgdev’s picture

sgdev commented

Looks good.

Well if concerned, can always make it another configuration option in the admin interface. :)

  • AohRveTPV committed 5014374 on 7.x-2.x authored by ron_s 
    Issue #2499341 by AohRveTPV, ron_s: Consecutive character count...
aohrvetpv’s picture

aohrvetpv commented
Status: Needs review » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.