3 ms·

Show HN: Common User Passwords Profiler (CUPP) in Rust

7 points by ElNiak 3y ago

ElNiak 3y ago
I translated the CUPP (Common User Passwords Profiler) program from Python to Rust. More details also at: https://medium.com/@elniak/boosting-chatgpts-performance-the-power-of-motivation-to-avoid-ai-lazyness-c68be040898a https://medium.com/@elniak/boosting-chatgpts-performance-the... "The most common form of authentication is the combination of a username and a password or passphrase. If both match values stored within a locally stored table, the user is authenticated for a connection. Password strength is a measure of the difficulty involved in guessing or breaking the password through cryptographic techniques or library-based automated testing of alternate values. A weak password might be very short or only use alphanumberic characters, making decryption simple. A weak password can also be one that is easily guessed by someone profiling the user, such as a birthday, nickname, address, name of a pet or relative, or a common word such as God, love, money or password. That is why CUPP was born, and it can be used in situations like legal penetration tests or forensic crime investigations." My Rust version: - 0,000000769s/word The original Python version: - 0,000005652s/word
- Tostino 3y ago
  I haven't dug into the code, so would you mind sharing how this is different than a tool like zxcvbn?
  - ElNiak 3y ago
    Hello there, No problem, CUPP (Common User Passwords Profiler) is a tool designed for generating potential passwords based on personal information inputs. It's often used in security testing and penetration testing to create personalized wordlists for password guessing attacks, leveraging user-specific data like names, dates, and interests. zxcvbn, on the other hand, is a password strength estimator used to evaluate the complexity and security of passwords. It assesses passwords based on various factors including dictionary words, predictability, and common patterns, providing a strength score and feedback to improve password security.
    - Tostino 3y ago
      Got it, appreciate you clearing that up. Essentially two sides of the same coin. I use a Java port (nbvcxz) that I wrote for securing our SaaS product, and we build personalized "exclusion dictionaries" for each user with things like their company name, first name, last name, email, etc. If the user tries to have those as part of their password, it will not add to the entropy of their password. We are limited in how much we know about each user though. Helps with the most egregious poor passwords, and should protect our customers/users from tools like this at least a bit.

7 points by ElNiak 3y ago

I translated the CUPP (Common User Passwords Profiler) program from Python to Rust. More details also at: https://medium.com/@elniak/boosting-chatgpts-performance-the-power-of-motivation-to-avoid-ai-lazyness-c68be040898a https://medium.com/@elniak/boosting-chatgpts-performance-the... "The most common form of authentication is the combination of a username and a password or passphrase. If both match values stored within a locally stored table, the user is authenticated for a connection. Password strength is a measure of the difficulty involved in guessing or breaking the password through cryptographic techniques or library-based automated testing of alternate values. A weak password might be very short or only use alphanumberic characters, making decryption simple. A weak password can also be one that is easily guessed by someone profiling the user, such as a birthday, nickname, address, name of a pet or relative, or a common word such as God, love, money or password. That is why CUPP was born, and it can be used in situations like legal penetration tests or forensic crime investigations." My Rust version: - 0,000000769s/word The original Python version: - 0,000005652s/word

Tostino 3y ago
I haven't dug into the code, so would you mind sharing how this is different than a tool like zxcvbn?
- ElNiak 3y ago
  Hello there, No problem, CUPP (Common User Passwords Profiler) is a tool designed for generating potential passwords based on personal information inputs. It's often used in security testing and penetration testing to create personalized wordlists for password guessing attacks, leveraging user-specific data like names, dates, and interests. zxcvbn, on the other hand, is a password strength estimator used to evaluate the complexity and security of passwords. It assesses passwords based on various factors including dictionary words, predictability, and common patterns, providing a strength score and feedback to improve password security.
  - Tostino 3y ago
    Got it, appreciate you clearing that up. Essentially two sides of the same coin. I use a Java port (nbvcxz) that I wrote for securing our SaaS product, and we build personalized "exclusion dictionaries" for each user with things like their company name, first name, last name, email, etc. If the user tries to have those as part of their password, it will not add to the entropy of their password. We are limited in how much we know about each user though. Helps with the most egregious poor passwords, and should protect our customers/users from tools like this at least a bit.