The password quality scale

The algorithm used to calculate password quality is used to enforce the selection of passwords that are sufficiently complex to meet the password quality scale level chosen to protect user ID files. When a user is registered, the user's ID file contains a password strength value. This setting is enforced if the user changes the password.

The scale ranges from 0 (weakest -- no password required) to 16 (strongest). A quality of 1 indicates that any password satisfies the criteria. Domino® defines default levels for certifier, server, and user password quality. You should change these defaults to meet your organization's security criteria. You can set the defaults in a security settings policy document, in Administration Preferences, or in the registration or certification dialog boxes.

Password strength is not the same as password length. Not all passwords of equal length have equal strength in the password quality scale. For example, the 8-character word "password" (because it is a word) and the 8-character word "1168Acme" (because it contains numbers and alphabetic characters) do not carry the same level of character complexity and do not have equal strength on the quality scale.

Tips for assigning passwords and scale

• Do not use words in a password that are in the Domino® spell-check dictionary. Passwords containing words found in a Domino® spell-check dictionary are generally weaker than passwords of equal length that do not contain words from the spell-check dictionary.
• Use mixed-case words and words that contain numbers and punctuation for passwords instead of entirely lowercase alphabet characters. To make a password stronger without making it longer, avoid using words; instead use mixed-case characters and include punctuation and numbers.
• Use a passphrase instead of a password. A complete sentence, especially one with a word or two misspelled, is a strong password that an attacker would have difficulty guessing.
• Use passwords that have a quality of 12 or greater. Passwords that have a quality of 12 or greater are resistant to an automated attack. Passwords that have a quality of less than 4 are easy to guess.
• Set a default value for all Password Quality Scale fields so that all passwords assigned to servers, users, and certifier IDs in your organization have appropriate levels of complexity.

Understanding the algorithm

Digits in the last position and uppercase letters in the first position do not qualify as bonus characters because these are commonly used modifications to passwords to evade password-checking mechanisms.

In addition, the rating decreases if the password contains anything that can be programmatically determined to be predictable, for example, words in a dictionary or repeating characters.