What is the point of making a complicated PUBLIC password?

Question

I have downloaded a couple of Virtual Machine images from http://modern.ie, in order to test different versions of Internet Explorer.

When running these images, a complete Windows environment is started, with a default user account. The details for the user account are displayed in clear text on the Windows desktop background:

What is the reason for complicating the password (e.g. Passw0rd! instead of just password), when the password is clearly visible to anyone, and is supposed to be public?

Answer 1

In addition to the password policy (upper case+lower case letters, number, non alphanumeric character, >8 digits), it also leads to clarity. Some users might be confused by the password being password, depending how it's displayed, especially if it's mixed with other information. Yet for all but the mentally challenged users it's immediately clear that Passw0rd! is a password, which reduces the amount of support queries.

Answer 2

Reason may be:

This Windows has implemented a strong password policy, thus the user MUST HAVE a "strong" password.

Answer 3

Password policy.

You have to jump trough some hoops to get Windows to accept "password" (no capitals, no digits, no non-alphanumerics).

But it will accept "Passw0rd!" right out of the box.

Answer 4

Depending on how the virtual machine is configured, the password complexity may be a requirement that's enforced by the system's security settings.

1. On the virtual machine, run secpol.msc.
2. Navigate to: Security Settings\Account Policies\Password Policy
3. Observe the value for "Password must meet complexity requirements"

By default, standalone systems have this disabled. Domain controllers, and other systems that are members of a domain, have it enabled by default. If the system is not a domain controller or domain member, it's possible that the developers manually applied a security template to the VM.

If you double-click that setting, and go to the "Explain" tab, you'll see exactly what this policy enforces. I've also listed the requirements below.

---

The password must...:

• Not contain the user's account name.
• Not contain more than two consecutive characters out of the user's full name.
• Be at least six characters in length (unless another minimum length is specified).
• Contain characters from 3 of the 4 character types:
  • Uppercase letters
  • Lowercase letters
  • Numbers
  • Non-alphanumeric characters

---

If the setting is disabled, then another possibility is that Passw0rd is just a one-size-fits-all, generic password that the developers are accustomed to using so that it will be accepted on any system they're testing. (Though, it should be noted that this would not be accepted on any systems using CIS/NIST security templates - those require a minimum of 12 characters.)

Answer 5

The only reason I can think of, is the case when the password is meant to be changed and they want to indicate to the users that they should use a complex password.

Answer 6

The site you point to is a site for developer tools, and specifically VMs created for the sole purpose of testing different versions of IE.

Casually released developer tools like this normally are given far less scrutiny, and are less polished than a full release of a major product. There's really no good reason why Passw0rd! is any more secure than password, especially when it's public. It's likely that the developer who created the VM didn't give it more than 2 minutes worth of thought, and it was never scrutinized beyond that.