cybersecurity · intermediate · ~15 min

Detect weak passwords

Defence-in-depth — local heuristics never replace a proper password policy and hashing scheme.

Challenge

Flag obviously weak passwords using a few simple heuristics (a teaching aid, not a real policy).

Task

Implement int is_weak_password(const char *p) that returns 1 if the password is weak by any of these rules, otherwise 0. No main — the grader calls it.

Weak if any of:

  1. Length is less than 8.
  2. All characters are identical.
  3. All characters are digits.
  4. It exactly equals one of: password, 123456, qwerty, letmein.

Input

p: a NUL-terminated candidate password.

Output

1 if the password is weak by any rule above, 0 otherwise.

Example

is_weak_password("abc")          ->   1   (too short)
is_weak_password("aaaaaaaa")     ->   1   (all same)
is_weak_password("12345678")     ->   1   (all digits)
is_weak_password("password")     ->   1   (common)
is_weak_password("Tr0ub4dor!")   ->   0

Edge cases

  • An 8+ character mixed password that is not in the common list returns 0.

Rules

  • These heuristics are illustrative only; real systems hash with a slow KDF and check against breach lists.

Input format

A NUL-terminated candidate password p.

Output format

1 if weak by any rule (short, all-same, all-digit, common), else 0.

Constraints

Heuristic teaching aid only, not a real password policy.

Starter code

#include <string.h>

int is_weak_password(const char *p) {
    /* TODO */
    return 0;
}

Solve this exercise in the browser editor — compile and run against the test harness, no setup required.