weak password subgroup of password, 2 assertions