3 ms·
I'm trying to figure out if I need to do this if I'm requiring minimum sixteen characters... after searching the docs and several of the blog posts, I can't asc
by mynameismonkey 8y ago
I'm trying to figure out if I need to do this if I'm requiring minimum sixteen characters... after searching the docs and several of the blog posts, I can't ascertain if the corpus contains any passwords/phrases >= 16 characters. I don't want to be running this check on every passphrase create/modify if the corpus contains none or very very few passes length 16 or greater. Does anyone have any insight into the contents? Or, a way to query only the portion of the corpus that has 16 or greater?
- michaelbanfield 8y agoI just tried 'passwordpassword' and it was there. You can download the whole dataset at the bottom of this page https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords Its a losing battle trying to add byzantine rules to prevent users doing things like using their normal password * 2, so its probably a reasonable check to add.
- mynameismonkey 8y agoAha, I tried a few obvious 16s but not that one... thank you! I guess we'll add it in. The last few dumps (other sources) I reviewed contained nothing over 15 characters, but I'm imagining they will start creeping in as more folks demand longer phrases. Still, I'd bet the vast majority of the bad passes are <16, seems a heck of a waste of energy and bandwidth to check my user's passphrases against (guesstimating) 0.05% of the corpus.