Re:Zxcvbn: realistic password strength estimation
by tomp on Tuesday April 10, 2012 @06:38PM
(#3824846)
In general, email addresses should make quite good passwords ([email protected]). However, limiting yourself to yourname.yoursurname@yahoo/google.com reduces the entropy a lot.
Also, the idea of passwords are easy-to-remember&hard-to-guess. The only emails easy to remember are the one's you're using currently, which shouldn't be to hard for an attacker to figure out (in general).
Re:Zxcvbn: realistic password strength estimation
by rplnt on Wednesday April 11, 2012 @05:18AM
(#3826642)
What about:
Easy to remember yet hard to guess. (Unless you read this comment)
Re:Zxcvbn: realistic password strength estimation
by dullcrisp on Tuesday April 10, 2012 @06:14PM
(#3824738)
"dropbox.com" is ranked Good and "http://www.dropbox.com is ranked Great. I found this amusing, but as it says in the article, there are very many common patterns which it doesn't check and so overestimates the entropy of passwords using those patterns.
Re:Zxcvbn: realistic password strength estimation
by lowe on Tuesday April 10, 2012 @06:05PM
(#3824711)
zxcvbn gives high entropy for emails because it isn't matching against them currently. if there's good evidence that people commonly use emails as passwords (and crackers try emails as guesses!) it'd be a great pattern to add.
I wonder if that's because email addresses are really hard to crack or if it's because the rules of this scoring system weren't designed to account for such a practice. Not a practice of using your real email address as a password, but the practice of using a fictional email address as a password.