Re: [vchkpw] [SPAM] Password strength bug

2015-09-21 Thread Tonix - Antonio Nati
Il 21/09/2015 14:59, Drew Wells ha scritto: On 09/17/2015 12:28 PM, Tonix - Antonio Nati wrote: Il 17/09/2015 13:18, Drew Wells ha scritto: On 09/15/2015 03:27 PM, Tonix - Antonio Nati wrote: Il 15/09/2015 15:03, Drew Wells ha scritto: On 09/15/2015 11:00 AM, Tonix - Antonio Nati wrote: Il

Re: [vchkpw] [SPAM] Password strength bug

2015-09-21 Thread Drew Wells
On 09/21/2015 02:26 PM, Tonix - Antonio Nati wrote: Il 21/09/2015 14:59, Drew Wells ha scritto: On 09/17/2015 12:28 PM, Tonix - Antonio Nati wrote: Il 17/09/2015 13:18, Drew Wells ha scritto: On 09/15/2015 03:27 PM, Tonix - Antonio Nati wrote: Il 15/09/2015 15:03, Drew Wells ha scritto: On

Re: [vchkpw] [SPAM] Password strength bug

2015-09-21 Thread Matt Brookings
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 09/21/2015 08:55 AM, Drew Wells wrote: >> I think that permitting a null password, if policy does not admit it, is a >> security hole. >> Prefer you you add another explicit call to be called for no password >> checking (at all). >> >> Regards,

Re: [vchkpw] [SPAM] Password strength bug

2015-09-21 Thread Drew Wells
On 09/17/2015 12:28 PM, Tonix - Antonio Nati wrote: Il 17/09/2015 13:18, Drew Wells ha scritto: On 09/15/2015 03:27 PM, Tonix - Antonio Nati wrote: Il 15/09/2015 15:03, Drew Wells ha scritto: On 09/15/2015 11:00 AM, Tonix - Antonio Nati wrote: Il 15/09/2015 11:03, Drew Wells ha scritto: In

Re: [vchkpw] [SPAM] Password strength bug

2015-09-21 Thread Drew Wells
On 09/21/2015 03:02 PM, Matt Brookings wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 09/21/2015 08:55 AM, Drew Wells wrote: I think that permitting a null password, if policy does not admit it, is a security hole. Prefer you you add another explicit call to be called for no password