On the koha/members/member-password.pl I asked it to suggest a password, and it suggested one with four characters. For the reasons discussed in bug 9885, that seems too few. The suggestion accepted there was twelve characters.
As far as I can tell, the password being generated by Koha respcts the minPasswordLength syspref, so libraries that want better security can just set this syspref to a high number. But perhaps it would be a good idea to set the default for minPasswordLength higher than 4?
(In reply to comment #1)
> As far as I can tell, the password being generated by Koha respcts the
> minPasswordLength syspref, so libraries that want better security can just
> set this syspref to a high number. But perhaps it would be a good idea to
> set the default for minPasswordLength higher than 4?
+1 for a higher default, but 12 may be a problem in terms of usability?
Not mentioning passwords submitted over http :)
Created attachment 33134 [details] [review]
Patch to increase password length
To be honest, I haven't tested this patch. But it is so simple, "what could possibly go wrong". I don't have time to test it right now so am uploading it but leaving the status unchanged.
Sorry, I should have said - the patch increases the default length to 12. The default length was discussed in bug 9885.
Setting to Needs Signoff as it looks like this is ready to be tested by someone
This patch changes db rev 3.00.00.031.
It should add a new db rev.
*** This bug has been marked as a duplicate of bug 18308 ***