Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zxcvbn: realistic password strength estimation

tech.dropbox.com

Post reply on HN
Print view View original

11–20 of 134 posts

Re: Zxcvbn: realistic password strength estimation

#11

Post by ashishgandhi »

The article mentions that non-English language support as a future improvement. Since the article is long that it's easy to miss this point and to put that in perspective how important that is here's an example:

  yehtohaasanhaiguesskarna
That means "This is easy to guess" in Hindi transliteration. Only English support would say it will take "centuries" to guess. (http://dl.dropbox.com/u/209/zxcvbn/test/index.html)

Re: Zxcvbn: realistic password strength estimation

#12

Post by Tossrock »

ashishgandhi wrote: post #11

The article mentions that non-English language support as a future improvement. Since the article is long that it's easy to miss this point and to put that in perspective how important that is here's an example: yehtohaasanhaiguesskarna That means "This is easy to guess" in Hindi transliteration. Only English support would say it will take "centuries" to guess. ( http://dl.dropbox.com/u/209/zxcvbn/test/index.html )

Did hindi take "guess" as a loanword or is that just a massive coincidence

Re: Zxcvbn: realistic password strength estimation

#13

Post by ashishgandhi »

RandallBrown wrote: post #10

I hate when they won't let me use a password that's not "strong" enough. I picked my password, let me use it. I know the consequences of using an easy password.

But majority of their users most likely do not know the consequences of using an easy password. And then they would blame the bank and the Internet.

Re: Zxcvbn: realistic password strength estimation

#15

Post by ashishgandhi »

Tossrock wrote: post #12
ashishgandhi wrote: post #11

The article mentions that non-English language support as a future improvement. Since the article is long that it's easy to miss this point and to put that in perspective how important that is here's an example: yehtohaasanhaiguesskarna That means "This is easy to guess" in Hindi transliteration. Only English support would say it will take "centuries" to guess. ( http://dl.dropbox.com/u/209/zxcvbn/test/index.html )

Did hindi take "guess" as a loanword or is that just a massive coincidence

Loan word. I can't remember the the Hindi word for "guess" right now.

PS: Although I don't remember the exact words but there were some which are strikingly similar in both languages. But I found this for you. http://en.wikipedia.org/wiki/List_of_English_words_of_Hindi_...

Re: Zxcvbn: realistic password strength estimation

#16

Post by aqme28 »

RandallBrown wrote: post #10

I hate when they won't let me use a password that's not "strong" enough. I picked my password, let me use it. I know the consequences of using an easy password.

I hate when they won't let me use a password that's too strong. Nothing makes less sense to me than rejecting a password because it contains '!' or '#'.

Re: Zxcvbn: realistic password strength estimation

#17

Post by aqme28 »

landr0id wrote: post #2

> Bank of America doesn’t allow passwords over 20 characters, disallowing correcthorsebatterystaple. Passwords can contain some symbols, but not & or !, disallowing the other two passwords Can anyone elaborate why "&" or "!" wouldn't be allowed?

There's a system I used at work that actually stripped my password of some characters, but still allowed me to register. Couldn't figure out for the life of me why the password I just typed wasn't being recognized.

Re: Zxcvbn: realistic password strength estimation

#18

Post by jjcm »

I created something similar a while back to demonstrate what makes a password secure. It's drastically less sophisticated than this (I wrote it in an hour or so), but it has the same approach - evaluating a password by entropy, not random requirements. http://files.jjcm.org/jspass/

The important thing I found while testing this was that it was important to tell users why their password sucked. Often times, they'll just keep adding 1's to the end of their password until it's good enough. Let people know, "Your password is in a known list of passwords", rather than, "The entropy of your password is 0."

Post reply on HN