New password not accepted - Invalid password

[mtnmerks]

I received an email stating I need to change my password or get locked out.
I have attempted to change the password several times in the last few days.
No matter what password I enter, I keep getting this message:
Invalid password due to ease or frequency of use. Try adding additional words or characters.

[russellhltn]

Invalid password due to ease or frequency of use.

Interesting. The church may have stepped up the game on passwords. You may have selected a password that's too common (Password123), or a "keyboard walk" (asdfgh). Some systems will also reject passwords that you've used before.

My personal method is to use a random word generator and string 2-3 words together. Sprinkle in some numbers and punctuation as needed and you're good to go. Words are a lot easier to remember if you can make a mini-story out of them.

This is another generator with some explanation.

[mtnmerks]

I do not use common passwords. I tried several different passwords. The only warning message I get is: Password must be at least 8 characters.
Is there some other criteria that I'm not aware of?
On this system, I have never used any of the new passwords that I'm trying.
Other systems do not have a problem with my password variations.

[russellhltn]

I played with the tool a bit.

• "asd" - Password must be at least 8 characters.
• "password" - Invalid password due to ease or frequency of use. Try adding additional words or characters.
• "password123" - Invalid password due to ease or frequency of use. Try adding additional words or characters.
• "password123321 - (accepted)

I also tried "evangeli" which is #9998 of the most common passwords (caution, bad language), and it wouldn't take it. So, the checking seems to be at least 10,000 common passwords words deep.

At this point, I think the system is checking your password with some of the most commonly used passwords. This is a new recommendation from NIST (US National Institute of Standards and Technology) and is the first time I've seen it. The fact other systems accept your password shows they're still on the old standard. I'd suggest that instead of one word, you combine a few words. For example, "qwertydragon" was acceptable even though that's #5 combined with #7.

If you want to check and see how common your password is, you can go here.

Personally, I think the church should be congratulated for stepping up it's game.

[mtnmerks]

Thanks for the additional info. I finally got one to work.
Apparently, something in the password I was trying must be considered "common", even though the full password is very unique, with numbers, symbols, lowercase and uppercase.
In my opinion, it goes a little too far when only a portion of the password is considered "common".

[mtnmerks]

I was experimenting today, and the message has changed to indicate the password must be 12 characters now.

[russellhltn]

the message has changed to indicate the password must be 12 characters now.

Time to get rid of "password" and use "passphrase". I'd think the number of long words would be rather limited.

[JohnSLydiate]

I am trying to find some help sort out my FIR account log on please
john Lydiate
Dunedin Stake

[rmrichesjr]

I am trying to find some help sort out my FIR account log on please
...

This is a user-to-user discussion forum, not an official help request channel.

If I understand correctly, one of the Church apps stores your password internally and keeps trying to log in. When you change your password, the app keeps trying the old password, which fails. After several such attempts, the server locks your account. If you update the app with your new password and shut off the device for an hour or so, and quit attempting to log in manually for that same time, your account should become unlocked. If that does not work, please contact your ward clerk.

[russellhltn]

I am trying to find some help sort out my FIR account log on please

It's going to be the same login as the main churchofjesuschrist.org page, as well as calendar, member tools, etc.

You have to be holding a calling that grants access. A list of callings with access can be found here.