I think the wording of this option in CP is confusing.
Documentation states that “Disabling will make ‘dictionary attacks’ by hackers much more difficult.” - but for this to be so there needs to be a dictionary file (normally there isn’t). In the default install this option is disabled, suggesting that dictionary attacks are prevented; but since there is by default no dictionary.txt file installed, it actually does nothing. In the default case it is possible that people will think they have disabled dictionary passwords and actually have not.
A better option might be to change this option to be one where the user has to opt-in to dictionary protection (which is implicitly what is required now anyhow) - so option becomes “Prevent use of Dictionary Passwords” and the following entry (which gives name of dictionary file) could be required (and perhaps actively checked to ensure that the named dictionary was present in config folder) before allowing setting to be saved.
Packet Tide owns and develops ExpressionEngine. © Packet Tide, All Rights Reserved.