31–40 of 134 posts
The demo at http://dl.dropbox.com/u/209/zxcvbn/test/index.html shows what's happening behind the scenes. The one usability problem I see is users complaining that zxcvbn is calling their 'secure' password they use on everything insecure. :-)
> Bank of America doesn’t allow passwords over 20 characters, disallowing correcthorsebatterystaple. Passwords can contain some symbols, but not & or !, disallowing the other two passwords Can anyone elaborate why "&" or "!" wouldn't be allowed?
Not answering your question, but the most inane thing I've seen is sites that have a password character limit but then don't tell you, and only save the first X number of characters. There probably is a special level of hell for UI UX sins.
Password fields that are too short cause a similar problem, where you ask "am i still typing? did it cut me off?"
We purposely made the fields huge to help with this on: https://www.dropbox.com/register
Earlier quoted context omitted.
It certainly needs more tweaking. FJ, FJFJ, etc isn't in any of the 10k passwords people commonly use, isn't a sequence, isn't a single repeated character, etc, so zxcvbn recognizes it as bruteforce. A fun extension would be to recognize repeated chunks in addition to single characters.
One thing would be to try to measure entropy in a different way, e.g. run gzip on it. Right now FJFJFJFJ has the same entropy as FJGJFJGJ.
I feel like this is a stupid question, but what is wrong with having your password be something like "p4ssw0rd"? eg: a dictionary word where a few of the letters are switched for numbers, and maybe even a symbol at the end ("p4ssw0rd$") are these terrible passwords for some reason?
UTP+NnhabgHKx6
So I make a different password and the sites say it is too weak as it has no special chars or uppercase chars:
5133fe36785a6e01cac7a68c9c111afff5bb4821
So I give up and type Password1 which is normally accepted.
It certainly needs a rule for putting spaces between the words. "correct horse battery staple" and "correcthorsebatterystable" should be treated as being approximately equal in strength.
horsebattery -- 3 minutes
h orsebattery -- 8 years
ho rsebattery -- centuries
horseb attery -- 85 years
horsebat tery -- 54 years
Also:
abcde -- instant
a b c d e -- centuriesEvery time I'm forced to have a password with 3 or 4 character classes I sigh and think of that xkcd comic
Edit: also try typing the password from the xkcd comic here https://www.dropbox.com/register
nice touch
I feel like this is a stupid question, but what is wrong with having your password be something like "p4ssw0rd"? eg: a dictionary word where a few of the letters are switched for numbers, and maybe even a symbol at the end ("p4ssw0rd$") are these terrible passwords for some reason?