Zxcvbn: realistic password strength estimation • Hacker News Board

Re: Zxcvbn: realistic password strength estimation

#131

Post by blake8086 » Wed, Apr 11, 2012, 7:13 PM UTC

drostie wrote: post #46

blake8086 wrote: post #5

This seems like a great step forward, but it's still a bunch of ad-hoc rules. While the ruleset is definitely well-put-together and fairly comprehensive, it still doesn't seem like the most accurate measure. It seems like password strength basically boils down to: 1) imagine the space of all possible passwords 2) put them in order from most to least likely (123456 would be at the top, some giant 64 character random m…

That's probably the wrong way to think about it, and might -- as it does in this case -- lead to a ridiculously oversized password-guessing implementation which tries to do too much fancy business. The most obvious way to do password strength checking would not (I don't think) let you "use this list to begin cracking", but would instead estimate the Kolmogorov complexity of the password, as a proxy for its entropy. T…

I assume since you mentioned Kolmogorov complexity, that you probably have an understanding of how compression works.

Why would you add the layer of indirection of running a compression algorithm over something, when it has to measure the same thing you're trying to get at?

Given a character '1' at the beginning of a password, how likely is it that '2' is the next character? Compression tools answer this question, but then they go a different direction with the application of their answer.

Also, if your password guesser guesses anything but '123456' as its first guess, it's suboptimal, since that really is the most frequent password.

Re: Zxcvbn: realistic password strength estimation

#132

Post by drostie » Wed, Apr 11, 2012, 8:28 PM UTC

blake8086 wrote: post #131

drostie wrote: post #46

Earlier quoted context omitted.

That's probably the wrong way to think about it, and might -- as it does in this case -- lead to a ridiculously oversized password-guessing implementation which tries to do too much fancy business. The most obvious way to do password strength checking would not (I don't think) let you "use this list to begin cracking", but would instead estimate the Kolmogorov complexity of the password, as a proxy for its entropy. T…

I assume since you mentioned Kolmogorov complexity, that you probably have an understanding of how compression works. Why would you add the layer of indirection of running a compression algorithm over something, when it has to measure the same thing you're trying to get at? Given a character '1' at the beginning of a password, how likely is it that '2' is the next character? Compression tools answer this question, bu…

The only reason I'd add the layer of indirection is "they've already done it for me, but they didn't expose the API." I would also be interested in training a Bayes classifier or a neural network, but again, those aren't as easy to do as just appending two passwords to the end of a dictionary copies and feeding them to gzip.

Re: Zxcvbn: realistic password strength estimation

#133

Post by wh-uws » Wed, Apr 11, 2012, 9:37 PM UTC

vog wrote: post #119

eblume wrote: post #61

Earlier quoted context omitted.

For the lazy, if you enter "correcthorsebatterystaple" the password strength gets set to "lol" with an info-box that reads something along the lines of "Don't take the webcomic too seriously. :)"

I find that message misleading. The xkcd comic does have a point, and thus should be taken seriously. (Despite the obvious downside that those passwords take longer to type, which is why I still prefer short, cryptic passwords.) So a better message might be: "Don't follow the webcomic too closely. :)"

Its saying dont use that particular password. Any attacker of this script would know what it was inspired by and attempt that password in a dictionary.

Rendering it about as useless as 123456789 in this instance

Re: Zxcvbn: realistic password strength estimation

#134

Post by schiffern » Sat, Apr 14, 2012, 3:25 PM UTC

vog wrote: post #119

eblume wrote: post #61

Earlier quoted context omitted.

For the lazy, if you enter "correcthorsebatterystaple" the password strength gets set to "lol" with an info-box that reads something along the lines of "Don't take the webcomic too seriously. :)"

I find that message misleading. The xkcd comic does have a point, and thus should be taken seriously. (Despite the obvious downside that those passwords take longer to type, which is why I still prefer short, cryptic passwords.) So a better message might be: "Don't follow the webcomic too closely. :)"

It actually says, "Woah there, don't take advice from a web-comic too literally!"