The bug

When you try to set a password you have used before it shows you "Not strong enough! Must be at least 8 characters. Mix numbers, letters and symbols." even if the password matches these criteria. This can be quite confusing. Showing a more appropriate message might be better (unless it reveals too much about how the user chooses their passwords).