Ebay posts every character a user types into the password box

Re:Ebay posts every character a user types into the password... by FabHK on Wednesday June 29, 2016 @10:30AM (#12001831)

This might get downvoted because it's just a link, but:

zxcvbn is actually a great password strength library, JavaScript, client-side, and only about 400 kB or so last time I checked (compressed, including (!) dictionaries). It was developed by a Dropbox engineer for the password setting/changing dialog at Dropbox, and open sourced, if I'm not mistaken.

Again, this is a great tool, client side, small (smaller than most webpages and adds these days at any rate), and it also allows to provide a list of "custom black list words" not to use in the password (e.g. username, site name, etc.).

AFAIK, zxcvbn really is the gold standard here.

Given this, I don't really see how a server-side check is better or necessary. Ebay really ought to provide a much better answer than "trust us" here.

[ Parent | on HN ]

Re:Ebay posts every character a user types into the password... by TorKlingberg on Wednesday June 29, 2016 @10:32AM (#12001848)

You can do a lot of server round trips before you reach 400 kB.

[ Parent | on HN ]

Re:Ebay posts every character a user types into the password... by tnorthcutt on Wednesday June 29, 2016 @12:53PM (#12002902)

What's better: A) compromising security but using less bandwidth, or B) using more bandwidth, but staying secure?

Besides, the password strength js can easily be loaded async.

[ Parent | on HN ]

Re:Ebay posts every character a user types into the password... by majewsky on Wednesday June 29, 2016 @11:18AM (#12002153)

Yes, but these 400 kB won't contain any personal data.

[ Parent | on HN ]