4 ms·

https://github.com/dropbox/zxcvbn https://github.com/dropbox/zxcvbn

• FabHK 10y ago
  This might get downvoted because it's just a link, but: zxcvbn is actually a great password strength library, JavaScript, client-side, and only about 400 kB or so last time I checked (compressed, including (!) dictionaries). It was developed by a Dropbox engineer for the password setting/changing dialog at Dropbox, and open sourced, if I'm not mistaken. Again, this is a great tool, client side, small (smaller than most webpages and adds these days at any rate), and it also allows to provide a list of "custom black list words" not to use in the password (e.g. username, site name, etc.). AFAIK, zxcvbn really is the gold standard here. Given this, I don't really see how a server-side check is better or necessary. Ebay really ought to provide a much better answer than "trust us" here.
  • TorKlingberg 10y ago
    You can do a lot of server round trips before you reach 400 kB.
    • majewsky 10y ago
      Yes, but these 400 kB won't contain any personal data.
    • tnorthcutt 10y ago
      What's better: A) compromising security but using less bandwidth, or B) using more bandwidth, but staying secure? Besides, the password strength js can easily be loaded async.