Bugzilla – Bug 5594
SSH login password font is ambiguous due to its use of mixed case among other things
Last modified: 2007-11-09 09:24:27 UTC
The ssh login password is difficult to read because it is ambiguous. The login password should be in a very readable font (maybe fixed width like courier?), and should exclude ambiguous characters, such as 1, I, l, 0, O, o. It's probably better to use a longer password with a reduced character set. It could use just numbers perhaps, or just numbers & lower case letters (except 1 and l).
Or just change this back to passwd again. I think the random password is too difficult to use, and does not really add much value/security.
it is rather annoying to have to keep making note of the variying random password with regular need todo factory reset. it's not uncommon for devices to ship with a very simple default password, and it's not like ssh is enabled by default. however, we do need an easy way to set up a custom password for general use.
For security reasons, we should probably have some way to secure, say, the WPA passwords. Are they stored in clear text on the Jive? If so, you could grab it via anonymous SSH. Of course, you'd have to already be on the network to do that, but perhaps it could be done when Jive is in promiscuous mode. Dunno. A 4 digit numeric string would provide enough security -- only give 10 attempts or something before requiring a factory reset to gain ssh access.
the password in stored in wpa_supplicant.conf, plain text but I think users should generally be keeping ssh off unless they are doing dev work. Being able to turn on and off easily with a persistent password would be a big step in taht simplicity. however, it would seem that there should be some sort of standard security solution for wpa_supplicant.conf files as I'm sure many systems with ssh don't really have random passwords.
Richard suggests we select a default password that is simple and clear as a workaround. Dean suggests 'squeezebox'
The end of the conversation settled on a password of '1234'
Changed to a fixed password of 1234 and added a motd file instructing the user how to modify the password when they login via ssh. All done in r853 + r854.