Zxcvbn: realistic password strength estimation

Re:Zxcvbn: realistic password strength estimation by DanielStraight on Tuesday April 10, 2012 @04:49PM (#3824355)

Not to mention:

  horsebattery -- 3 minutes
  h orsebattery -- 8 years
  ho rsebattery -- centuries
  horseb attery -- 85 years
  horsebat tery -- 54 years

Which at the very least is a little odd, even if the reason (breaking up the words into less word-like structures) is clear.

Also:

  abcde -- instant
  a b c d e -- centuries

[ Parent | on HN ]

Re:Zxcvbn: realistic password strength estimation by lowe on Tuesday April 10, 2012 @06:22PM (#3824764)

zxcvbn's current analysis for 'correcthorsebatterystaple' vs 'correct horse battery staple' looks about right to me, it's counting each space as an extra bruteforce character.

horsebattery vs 'h orsebattery', on the other hand, shows a clear flaw -- it doesn't tolerate misspellings up to a given edit distance. edit distance is tricky because efficient word segmentation gets much harder, especially w/ support for l33t substitutions.

'abcde' vs 'a b c d e' is tricky too. i could add special case for spaces only that would allow zxcvbn to recognize 'a b c d e' as a sequence, but it wouldn't cover 'a-b-c-d-e', 'a8b8c8d8e' etc.

[ Parent | on HN ]

Re:Zxcvbn: realistic password strength estimation by allbutlost on Tuesday April 10, 2012 @04:56PM (#3824388)

Also,

  pas sw ord

Will apparently take centuries to crack. I see the reasoning, but can this be correct?

[ Parent | on HN ]

Re:Zxcvbn: realistic password strength estimation by zmj on Tuesday April 10, 2012 @05:25PM (#3824517)

Combinatorics. Yes.

[ Parent | on HN ]

Re:Zxcvbn: realistic password strength estimation by drostie on Tuesday April 10, 2012 @05:35PM (#3824580)

Well, no. In "password" you have one common word -- let's say 1,000 options, 2^10. You have two spaces which can go in any of 9 places, for 9 * 8 / 2 = 36 different places, plus I suppose the 1 and 9 for zero and one places.

46,000 options for 15.5 bits of entropy, only. Even if we assume that there are thousands of different "strategies" by which passwords might be chosen, that only adds ~10ish bits or so, and doesn't bring it under the useful thresholds.

[ Parent | on HN ]