3 ms·

I haven't dug into the code, so would you mind sharing how this is different than a tool like zxcvbn?

• ElNiak 3y ago
  Hello there, No problem, CUPP (Common User Passwords Profiler) is a tool designed for generating potential passwords based on personal information inputs. It's often used in security testing and penetration testing to create personalized wordlists for password guessing attacks, leveraging user-specific data like names, dates, and interests. zxcvbn, on the other hand, is a password strength estimator used to evaluate the complexity and security of passwords. It assesses passwords based on various factors including dictionary words, predictability, and common patterns, providing a strength score and feedback to improve password security.
  • Tostino 3y ago
    Got it, appreciate you clearing that up. Essentially two sides of the same coin. I use a Java port (nbvcxz) that I wrote for securing our SaaS product, and we build personalized "exclusion dictionaries" for each user with things like their company name, first name, last name, email, etc. If the user tries to have those as part of their password, it will not add to the entropy of their password. We are limited in how much we know about each user though. Helps with the most egregious poor passwords, and should protect our customers/users from tools like this at least a bit.