4 ms·
Thanks for igniting this discussion, Niten. While digging around, I stumbled onto this tool which others might find helpful: https://github.com/lowe/zxcvbn htt
by miles 14y ago
Thanks for igniting this discussion, Niten. While digging around, I stumbled onto this tool which others might find helpful:
https://github.com/lowe/zxcvbn https://github.com/lowe/zxcvbn
zxcvbn, named after a crappy password, is a JavaScript password strength estimation library. Use it to implement a custom strength bar on a signup form near you!
zxcvbn attempts to give sound password advice through pattern matching and conservative entropy calculations. It finds 10k common passwords, common American names and surnames, common English words, and common patterns like dates, repeats (aaa), sequences (abcd), and QWERTY patterns.
Sample results (including Tr0ub4dour&3 and correcthorsebatterystaple) and a demo can be found here:
http://dl.dropbox.com/u/209/zxcvbn/test/index.html http://dl.dropbox.com/u/209/zxcvbn/test/index.html
- luser001 14y agoPretty cool tool! My passphrases (omitting spaces between words) get a score of 2. But if I drop the vowels, the score goes to 4 and crack time to 'centuries'. I wonder if this is a good way to create passphrases. Anybody want to chime in?
- deleted 14y ago[deleted]
- tempestn 14y agoOriginally was going to chastise you for typing your actual passwords into a random demo version that could have been modified in whatever way. But since it's all js I guess it's a simple matter to verify it's not transmitting anything. Although I guess it could be some really devious thing where it saves the info in a cookie to be snagged later or some such. Did you check the JS code? ;)
- rorrr 14y agoDon't use phrases. Use one really strong password that you can remember with a tool like KeePass. Generate random long passwords (30 characters) for everything and store them in KeePass. I've recently converted all my accounts to that - my passwords are practically unbreakable, at least with the current tech. I feel way more secure than with the shit I had to memorize before.
- borski 14y agozxcvbn is great. We actually use it for people registering on https://www.tinfoilsecurity.com https://www.tinfoilsecurity.com
- rpearl 14y agoI also ported zxcvbn to python for those of you looking to integrate it into things that don't have javascript support (a native app or something--that was the original motivation for it). https://github.com/rpearl/python-zxcvbn/ https://github.com/rpearl/python-zxcvbn/ I am a bit slow at pulling patches (sorry, I just get super busy) but I do get to it eventually.
- cynwoody 14y agoInteresting. xyzzy scores 'instant'. My B of A pass phrase, Jer1m1ah Cl4rke, scores 31 years. Should I change it? https://dl.dropbox.com/u/209/zxcvbn/test/index.html https://dl.dropbox.com/u/209/zxcvbn/test/index.html Edit: I just checked 9223372036854775808L, and it answered 'centuries' with a suspiciously round crack time in seconds. Don't think so.
- mbreese 14y agoYou should probably change it now...
- patrickaljord 14y agoIf I enter the first 10 characters in regular order of my French azerty keyboard that are &é"'(-è_çà)= I get a top 4/4 score :). Not very good for security.
- miles 14y agoThe author of zxcvbn acknowledges this weakness (and others) here: https://tech.dropbox.com/2012/04/zxcvbn-realistic-password-strength-estimation/ https://tech.dropbox.com/2012/04/zxcvbn-realistic-password-s... zxcvbn currently only supports English words, with a frequency list skewed toward American usage and spelling. Names and surnames, coming from the US census, are also skewed. Of the many keyboard layouts in the world, zxcvbn recognizes but a few. Better country-specific datasets, with an option to choose which to download, would be a big improvement.