TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Zxcvbn: realistic password strength estimation

367 点作者 lowe大约 13 年前

28 条评论

16s大约 13 年前
Many sites won't accept my passwords (SHA1_Pass). They say that they are too long or have inappropriate chars or that they are not complex enough. Here's an example of inappropriate chars:<p>UTP+NnhabgHKx6<p>So I make a different password and the sites say it is too weak as it has no special chars or uppercase chars:<p>5133fe36785a6e01cac7a68c9c111afff5bb4821<p>So I give up and type Password1 which is normally accepted.
评论 #3824527 未加载
评论 #3825093 未加载
评论 #3825267 未加载
评论 #3825085 未加载
评论 #3826696 未加载
评论 #3826948 未加载
impendia大约 13 年前
&#62; One in nine people had a password in this top 500 list. These passwords include some real stumpers: password1, compaq, 7777777, merlin, rosebud.<p>Looks unbelievable at first. How could people be so stupid?<p>But I use such passwords all the time. I use a variety of websites where I have no need or desire for security. Want to post burrito reviews on burritophile.com as me? I picked something simple and easy to guess, a couple hours and you'll be going to town! (Just promise not to badmouth the Cosmic Cantina.)<p>My bank accounts? Oops, didn't use the same password.
评论 #3824405 未加载
评论 #3824453 未加载
wh-uws大约 13 年前
I have waited for this for so long. I'm glad someone finally took it up and and more importantly that its on a site as popular as dropbox. (this way hopefully the thinking will gain some traction)<p>Every time I'm forced to have a password with 3 or 4 character classes I sigh and think of that xkcd comic<p><i>Edit:</i> also try typing the password from the xkcd comic here <a href="https://www.dropbox.com/register" rel="nofollow">https://www.dropbox.com/register</a><p>nice touch
评论 #3824633 未加载
评论 #3825243 未加载
Lagged2Death大约 13 年前
I'm surprised to see that "correct horse battery staple" type pass-phrases really have to be <i>quite</i> long to score well, but that even comically short email addresses ("dlk3@mit.edu") score very highly. In fact, it looks like my ever-so-clever words-and-numbers web passwords ("Happy314Day") are all terrible, but all my email addresses all make maximum strength 4-point passwords.<p>I wonder if that's because email addresses are really hard to crack or if it's because the rules of this scoring system weren't designed to account for such a practice. Not a practice of using your real email address as a password, but the practice of using a fictional email address as a password.
评论 #3824846 未加载
评论 #3824443 未加载
评论 #3824738 未加载
评论 #3824711 未加载
ashishgandhi大约 13 年前
The article mentions that non-English language support as a future improvement. Since the article is long that it's easy to miss this point and to put that in perspective how important that is here's an example:<p><pre><code> yehtohaasanhaiguesskarna </code></pre> That means "This is easy to guess" in Hindi transliteration. Only English support would say it will take "centuries" to guess. (<a href="http://dl.dropbox.com/u/209/zxcvbn/test/index.html" rel="nofollow">http://dl.dropbox.com/u/209/zxcvbn/test/index.html</a>)
评论 #3824114 未加载
评论 #3824368 未加载
shabble大约 13 年前
If these sorts of 'strength checkers' become ubiquitous across enough places, I wonder how much value there will be in using reverse-engineered (most of these are in JS for UX latency reasons, right?) models of their strength testing as another parameter to your brute-forcing module.<p>Then you can automatically skip any password you know is <i>too</i> simple, because the site won't have allowed the user to set it in the first place. You could also de-weight any constructions your generator is using (keyboard locality, l33t, ..), rather than positively weighting them as is done now.<p>Intuitively, it seems like the more restrictions placed on a password (must have 1 <i>x</i> char, no more than 20 total chars, ...), the smaller the entire search space. But where is the inflexion point where these rules generate stronger passwords than they assist.<p>Then again, if you're doing your hashing and storage right, brute force ain't gonna help.
评论 #3824798 未加载
Splines大约 13 年前
I think it's interesting that "correcthorsebatterystapl" is more secure than "correcthorsebatterystaple".<p>Makes sense, but it's amusing to see the time <i>drop</i> as you add letters.
评论 #3825346 未加载
landr0id大约 13 年前
&#62; Bank of America doesn’t allow passwords over 20 characters, disallowing correcthorsebatterystaple. Passwords can contain some symbols, but not &#38; or !, disallowing the other two passwords<p>Can anyone elaborate why "&#38;" or "!" wouldn't be allowed?
评论 #3824101 未加载
评论 #3824025 未加载
评论 #3824251 未加载
评论 #3824145 未加载
评论 #3824278 未加载
评论 #3823986 未加载
varenc大约 13 年前
The demo at <a href="http://dl.dropbox.com/u/209/zxcvbn/test/index.html" rel="nofollow">http://dl.dropbox.com/u/209/zxcvbn/test/index.html</a> shows what's happening behind the scenes.<p>The one usability problem I see is users complaining that zxcvbn is calling their 'secure' password they use on everything insecure. :-)
评论 #3824535 未加载
评论 #3824016 未加载
评论 #3824292 未加载
bo1024大约 13 年前
Any password strength estimator worthy of the name ought to hardcode a list of those 10,000 passwords and disallow any of them. Add in standard algorithms and you're probably doing pretty well.
评论 #3824594 未加载
jjcm大约 13 年前
I created something similar a while back to demonstrate what makes a password secure. It's drastically less sophisticated than this (I wrote it in an hour or so), but it has the same approach - evaluating a password by entropy, not random requirements. <a href="http://files.jjcm.org/jspass/" rel="nofollow">http://files.jjcm.org/jspass/</a><p>The important thing I found while testing this was that it was important to tell users <i>why</i> their password sucked. Often times, they'll just keep adding 1's to the end of their password until it's good enough. Let people know, "Your password is in a known list of passwords", rather than, "The entropy of your password is 0."
评论 #3824529 未加载
CGamesPlay大约 13 年前
It certainly needs a rule for putting spaces between the words. "correct horse battery staple" and "correcthorsebatterystable" should be treated as being approximately equal in strength.
评论 #3824355 未加载
blake8086大约 13 年前
This seems like a great step forward, but it's still a bunch of ad-hoc rules. While the ruleset is definitely well-put-together and fairly comprehensive, it still doesn't seem like the most accurate measure.<p>It seems like password strength basically boils down to:<p>1) imagine the space of all possible passwords<p>2) put them in order from most to least likely (123456 would be at the top, some giant 64 character random monster at the bottom)<p>3a) if you're malicious, use this list to begin cracking<p>3b) if you're securing something, use this list to measure strength<p>An ideal password strength measurer would simply return the approximate rank of your password.
评论 #3824435 未加载
ig1大约 13 年前
It's not unlikely that "correcthorsebatterystaple" is in several password attack dictionaries now, so sites may be legitimately ranking it as a weak password.<p>But more importantly password strength meters don't result in stronger passwords. I saw an analysis a couple of months ago (unfortunately I didn't save the link) where they found showing password strength to the user had no impact on the strength of the password used. People would pick a password and then stick with it regardless of strength advice.
评论 #3824816 未加载
onions大约 13 年前
FJFJFJFJ takes "centuries"? Probably needs a little more tweaking.
评论 #3824213 未加载
brownbat大约 13 年前
I use a password locker. The only downside is that it makes setting up new accounts or changing passwords on an existing account slightly harder, which decrease usability and security a bit respectively.<p>Someone should RFC a common password API, so password lockers can query the password rules and set up a new account or change the password on an existing account in the background while I browse.<p>You might worry that this would increase the attack surface, or push people towards a single point of failure, but I think ending password reuse and simple passwords could make for a healthy net gain if you carefully designed the protocol with security in mind. (Throttling and preventing account enumeration would be two key issues, but they could be overcome.)
Shank大约 13 年前
The real problem with humans is that passwords are still hard to remember for multiple services. Doesn't matter if you have a secure password and it's used everywhere.<p>Likewise, if it's used with LastPass or 1Password style services, you face the problem of dealing with entering it. Though a desktop PC is fine for this, the best counter-examples are mobile devices.<p>LastPass on mobile: 1. Use app that needs a password. 2. Realize password is in LastPass. Exit app, find LastPass. 3. Open LastPass, and login. 4. Copy password. 5. Switch back to the other app. 6. Enter password.<p>This is so tedious that people are going to re-use some password just for the sake of not having to do the above every time.
评论 #3826742 未加载
评论 #3825599 未加载
mkjones大约 13 年前
Did anyone look at the linked site <a href="http://xato.net/passwords/more-top-worst-passwords" rel="nofollow">http://xato.net/passwords/more-top-worst-passwords</a>? I pulled his top 10k list, but it doesn't add up with his analysis. I get that the top 100 passwords only cover 14% of the accounts, not 40%. And the top 1000 passwords only cover 44%, not 91%. These numbers don't change his argument all that much, but I'm curious what I'm missing about the way he calculated his.
RandallBrown大约 13 年前
I hate when they won't let me use a password that's not "strong" enough. I picked my password, let me use it. I know the consequences of using an easy password.
评论 #3824135 未加载
评论 #3824116 未加载
评论 #3826252 未加载
pclark大约 13 年前
I feel like this is a stupid question, but what is wrong with having your password be something like "p4ssw0rd"? eg: a dictionary word where a few of the letters are switched for numbers, and maybe even a symbol at the end ("p4ssw0rd$") are these terrible passwords for some reason?
评论 #3824367 未加载
评论 #3824427 未加载
评论 #3824329 未加载
sjwright大约 13 年前
$^$^$^_ = crack time 26 days<p>$^$^$^i = crack time 3 months<p>$^$^$^z = crack time 5 years<p>Should the result vary so widely given the arguably minor variation?
评论 #3825822 未加载
评论 #3826653 未加载
tnash大约 13 年前
This is a really great step forward for password strength estimation. If the OSC could get going on it and add a bunch more patterns it could be a great solution. Perhaps I'll have time to work on some patterns.
colanderman大约 13 年前
Adding a digram or trigram model would be interesting, as having one of these could greatly reduce the crack time of an English sentence as compared to random English words.
Sidnicious大约 13 年前
FWIW, it looks like Google specifically rates correcthorsebatterystaple lower than similar passwords. I wonder if any of these websites have it in a dictionary?
georgeott大约 13 年前
Length beats entropy every time. Steve Gibson has covered this before.<p><a href="https://www.grc.com/haystack.htm" rel="nofollow">https://www.grc.com/haystack.htm</a>
评论 #3825848 未加载
brownbat大约 13 年前
This is great. I love how:<p>thisisastrongpasswor should take 20 hours to crack.<p>But just add a 'd' to the end, and crack time drops to: "instant"<p>Magnificent!
jksmith大约 13 年前
Try some of Reinhold's Diceware phrases. They hold up quite well with this.
FootballMuse大约 13 年前
评论 #3827563 未加载
评论 #3826124 未加载
评论 #3826055 未加载