News for hackers. Stuff that matters.

A comment on Zxcvbn: realistic password strength estimation. Parent comment

Re:Zxcvbn: realistic password strength estimation by lowe on Tuesday April 10, 2012 @04:22PM (#3824213)
It certainly needs more tweaking. FJ, FJFJ, etc isn't in any of the 10k passwords people commonly use, isn't a sequence, isn't a single repeated character, etc, so zxcvbn recognizes it as bruteforce.

A fun extension would be to recognize repeated chunks in addition to single characters.

[ Parent | on HN ]
Re:Zxcvbn: realistic password strength estimation by onions on Tuesday April 10, 2012 @04:28PM (#3824233)
One thing would be to try to measure entropy in a different way, e.g. run gzip on it. Right now FJFJFJFJ has the same entropy as FJGJFJGJ.
[ Parent | on HN ]
Re:Zxcvbn: realistic password strength estimation by lowe on Tuesday April 10, 2012 @04:46PM (#3824328)
That's a great idea. More generally, whatever the approach, I agree zxcvbn would be better with a more conservative rating for non-pattern-matched regions.
[ Parent | on HN ]