Why not let the administrator decide? [LWN.net]

Why not let the administrator decide?

Posted Aug 11, 2026 9:12 UTC (Tue) by alx.manpages (subscriber, #145117)
In reply to: Why not let the administrator decide? by mb
Parent article: Changes in shadow-utils password-expiration features

> or any other password that needs to be typed in all the time (going to the password manager 100 times a day is impractical).

Have you tried pass(1)? I use it even for passwords that I use (quite possibly) 100 times a day. It stores my SSH key passphrase, for example, and I have configured ssh(1) to read it from pass(1). Being a command, which prints to stdout (or clipboard, with -c), it's easy to set up programs to use it, and use it 100 times a day if necessary.

> And while we are at it get rid of stupid character rules as well. A password does not get noticeably better by forcing the user to add numbers, because that will just make them put a 1 at the end.

I wanted to do this some time ago, but found some reticence (IIRC, the same reasons; that is, users forced by regulations). However, seeing that this seems to be working and that regulators will be forced to change, it seems we can probably also do that. I don't remember the exact rules we have for what is a complex password in shadow-utils (they are of course optional).

to post comments

Why not let the administrator decide?

Posted Aug 11, 2026 9:45 UTC (Tue) by mb (subscriber, #50428) [Link]

Have you tried pass(1)?

I use my own password manager (https://github.com/mbuesch/pwman) since ages. It is command line and fully scriptable and pluggable into other apps that support this kind of thing. With ssh this might work. But with many other applications it doesn't (e.g. they have a GUI entry field only). So yeah, we might come down from 10 to 9 passwords that I absolutely have to remember.

I also do not want to unlock my pw database all the time, because that means I will have to frequently type in the most precious master password I have (people/cameras might see it). And it means that I have to decrypt all my passwords from the database into memory all the time (that's how it currently works. I have plans to fix this, but don't hold your breath), even if I just want to ssh into an raspberry-pi on my floor I unlock the keys to my whole life. And opening the password manager takes more time than usual, because the password is complex and the KDF is hard. I think the only options are remembering a dozen of main passwords or eventually use passkeys if everything supports this within the next three decades.

stupid character rules

I wanted to do this some time ago

Cool :)

Why not let the administrator decide?

Posted Aug 11, 2026 14:10 UTC (Tue) by Wol (subscriber, #4433) [Link]

Crazy idea, but might make administrators think ...

All of these stupid rules like "one special char, one number, etc etc", as you process and encrypt the password look for how many passwords suffer from them. Okay, you're going to get a few, but if you notice rather more than average, start downrating the strength of the passwords that match these rules.

You just want a mini database (plain text file) that says "x password changes, n complied with this stupid rule, o with that stupid rule, p with the other stupid rule", this isn't random, start complaining about passwords that match them. No need for the file to identify *which* stupid rule ...

At which point, any administrator who says "you need a strong password containing one special character, one number, one upper case, blah blah blah" is going to have the users coming back to them and saying "every time I try to follow the rules, the computer complains it's a weak password!".

Cheers,
Wol

Why not let the administrator decide?

Posted Aug 19, 2026 17:43 UTC (Wed) by LtWorf (subscriber, #124958) [Link]

i love pass. I also implemented support for calling it from trabucco so I can get a password in the copy buffer without using a shell of I need to paste it somewhere.