zxcvbn

Repository: https://github.com/dropbox/zxcvbn

Sorry, as I keep saying in this thread, the excellent client-side password strength checking library zxcvbn (https://github.com/dropbox/zxcvbn) is under 400 kB compressed including dictionaries, checking against "30k common passwords, common names and surnames according to US census data, popular English words from Wikipedia and US television and movies, and other common patterns like dates, repeats (aaa), sequences (abcd), keyboard patterns (qwertyuiop), and l33t speak" Thus, it is, as a matter of fact, quite possible to do reasonable password strength checking on the client side with a footprint that's a small fraction of many of today's ad-infested websites.

The (most excellent) zxcvbn password strength checking library [1] (developed by an engineer at Dropbox) is 400 kB (compressed) including dictionaries. [1] https://github.com/dropbox/zxcvbn

if (c.get().length < 8) C.isValid = !1, c.hasErrors = !0, c.errors = [{ message: "Password too short" }]; else if (c.get().length > 256) C.isValid = !1, c.hasErrors = !0, c.errors = [{ message: "Password too long" }]; else if (/^[a-zA-Z0-9`~!@#\$%^&*()_=+\[\]{};:'",.<>\/? -]*$/.test(c.get())) { var e = 0; /[a-z]/.test(c.get()) && (e += 1), /[A-Z]/.test(c.get()) && (e += 1), /[0-9]/.test(c.get()) && (e += 1), /[`~!@#\$%^&*()_=+\[\]{};:'",.<>\/? -]/.test(c.get()) && (e += 2), 3 > e ? (C.isValid = !1, c.hasErrors = !0, c.errors = [{ message: "Password too simple" }]) : (c.hasErrors = !1, c.errors.length = 0) } else C.isValid = !1, c.hasErrors = !0, c.errors = [{ message: "Invalid symbols in password"

> 1) Aren't there people using generators like Diceware that don't do the password management part? I'm not sure they're actually that common. Moreover, if someone is sophisticated enough to use a password generator I assume they have some sort of system for ensuring integrity. Also, if you're worried about someone changing their password to something they don't know, simply force a relogin and have effective password reset mechanisms. > 2) The industry's definition of "high security" is constantly changing. Industry might be getting more serious about encouraging higher security passwords, but standards for high security passwords haven't really changed much. People are just becoming less tolerant of low-security ones. In terms of estimating security, you can use something like https://github.com/dropbox/zxcvbn which does a pretty good j

For a mathematically rigorous password strength meter library, check out zxcvbn: http://github.com/dropbox/zxcvbn

Looks like they are using zxcvbn[1] to calculate the password entropy and converting it to a time with these parameters: computers speed factor ------------------------------------------------ ZX Spectrum k: 1300 // 30 guesses per hour (?) Mac Book Pro (2012) k: 1 // 10 guesses per second (?) Conficker botnet k: 5e-5 // 20000 guesses per second (?) Tianhe-2 Supercomputer, k: 3e-7 // 3000000 guesses per second (?) The following line of code suggests that the speed factor is compared to 10 password guesses per second: Passwrdr.crack_time = result['crack_times_seconds']['online_no_throttling_10_per_second']; [1] https://github.com/dropbox/zxcvbn

in addition to all of those, there are still plenty of ways to create weak passwords with at least 8 characters. Dictionary words, 12345678, and so on. You can make a smarter password strength meter, like zxcvbn[1], but its tricky and depends on many heuristics so I don't think it would be ideal for a password standard. [1] https://github.com/dropbox/zxcvbn

Dropbox open-sourced a realistic password estimator called zxcvbn which is excellent; https://github.com/dropbox/zxcvbn