Password Phrases

I recently read an article about using 'pass phrases' instead of 'pass words.' http://www.codinghorror.com/blog/2005/07/passwords-vs-pass-phrases.html

Excited and happy I went to switch my passwords in zen-cart on both the front end and the back end. here is the password I tried. (I dont use this any where.) "Notorious Gaming is my favorite guild I was in!".

That was thrown back at me because well, it must include a number. However if you look at statistics as shown at that link. x8Jf3!g8 is a valid password that would have passed your checks. Yet that password can be bruteforced in (less than 2 seconds?) Not sure which encryption algorithm you're using in zen cart. But even if its a stronger one that 2 seconds. My pass phrase as explained at codinghorror.com WOULD TAKE LONGER. Even if you used the word method as described my passphrase has 9 words as opposed to 8 letters. BETTER.

I was extremely upset when that didn't go through because it wanted a damn number. I thought it would be funny to add the troll 1's at the end of it so I tried. "Notorious Gaming is my favorite guild I was in!!!11!" FAIL.

Why does zen cart seem to not allow pass phrases? We are reduced to an old style user system utilizing stupid Pass Words. :no:

To add on a little. I mean this post as a report of zen cart disallowing stronger passwords and ask that it get fixed in future versions. Please do not move it as a support request post. I do intend on asking how to fix it in another thread. And this "Security Report" will go public. But it doesn't report any exploits usable now.

Thank you.

1. The requirement for the presence of at least one "digit" is a PCI matter, and has nothing to do with whether you can use "phrases" vs "words".

2. You are right: the password validation isn't allowing spaces in v1.5.0 or v1.5.1.
   This will be fixed in v1.5.2 and future versions.