Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zxcvbn: realistic password strength estimation

tech.dropbox.com

Post reply on HN
Print view View original

1–10 of 134 posts

Re: Zxcvbn: realistic password strength estimation

#5

Post by blake8086 »

This seems like a great step forward, but it's still a bunch of ad-hoc rules. While the ruleset is definitely well-put-together and fairly comprehensive, it still doesn't seem like the most accurate measure.

It seems like password strength basically boils down to:

1) imagine the space of all possible passwords

2) put them in order from most to least likely (123456 would be at the top, some giant 64 character random monster at the bottom)

3a) if you're malicious, use this list to begin cracking

3b) if you're securing something, use this list to measure strength

An ideal password strength measurer would simply return the approximate rank of your password.

Re: Zxcvbn: realistic password strength estimation

#6

Post by rmc »

varenc wrote: post #4

The demo at http://dl.dropbox.com/u/209/zxcvbn/test/index.html shows what's happening behind the scenes. The one usability problem I see is users complaining that zxcvbn is calling their 'secure' password they use on everything insecure. :-)

The one usability problem I see is users complaining that zxcvbn is calling their 'secure' password they use on everything insecure.

Good.

Re: Zxcvbn: realistic password strength estimation

#7

Post by _delirium »

landr0id wrote: post #2

> Bank of America doesn’t allow passwords over 20 characters, disallowing correcthorsebatterystaple. Passwords can contain some symbols, but not & or !, disallowing the other two passwords Can anyone elaborate why "&" or "!" wouldn't be allowed?

A not-very-great but traditional way to avoid some kinds of security holes is to sanitize your input by blacklisting anything that could be a shell/scripting/SQL metacharacter. Seems restrictions like that are still pretty common, either because it's actually still needed for security (alarming if true at BoA), or because it's now a sort of cargo-cult thing.

Re: Zxcvbn: realistic password strength estimation

#8

Post by lowe »

_delirium wrote: post #7
landr0id wrote: post #2

> Bank of America doesn’t allow passwords over 20 characters, disallowing correcthorsebatterystaple. Passwords can contain some symbols, but not & or !, disallowing the other two passwords Can anyone elaborate why "&" or "!" wouldn't be allowed?

A not-very-great but traditional way to avoid some kinds of security holes is to sanitize your input by blacklisting anything that could be a shell/scripting/SQL metacharacter. Seems restrictions like that are still pretty common, either because it's actually still needed for security (alarming if true at BoA), or because it's now a sort of cargo-cult thing.

sounds about right. screenshot of BofA's policy here: http://dl.dropbox.com/u/209/bofa_password_constraints.png

the forbidden list is: $ ^ ! [ ]

Re: Zxcvbn: realistic password strength estimation

#9

Post by AJ007 »

landr0id wrote: post #2

> Bank of America doesn’t allow passwords over 20 characters, disallowing correcthorsebatterystaple. Passwords can contain some symbols, but not & or !, disallowing the other two passwords Can anyone elaborate why "&" or "!" wouldn't be allowed?

Not answering your question, but the most inane thing I've seen is sites that have a password character limit but then don't tell you, and only save the first X number of characters.

There probably is a special level of hell for UI UX sins.

Post reply on HN