Re: validate_password_strength

[Georgi Kodinov]

Christian,

The password in your example is not encrypted, it's hashed. And the difference is that hashing is irreversible, i.e. you can't know the original password knowing the hash only (without employing special computationally extensive techniques).

So the answer to your question whether you can evaluate existing passwords by hash only is: not in the general case.

One way to fix that is to force a password rotation for the existing users, i.e. mark their passwords as expired. Then you still won't know their passwords, by they'd be able to login and change them so that they comply with the newly enforced password strength policy.

See http://dev.mysql.com/doc/refman/5.7/en/password-expiration-policy.html for more details on password expiration.