The password strength meter behaves in odd ways with strong passwords about mitro HOT 5 OPEN

There is a bloom filter of a bunch of common passwords. If any word on the
common password list appears, it penalizes it, see:
https://github.com/mitro-co/mitro/blob/master/browser-ext/login/frontend/static/js/passwords.js

On Thu, Jul 31, 2014 at 12:15 PM, Peter Eckersley [email protected]
wrote:

As you type a really strong password, the strength indicator goes up to
"strong" and then bounces back down to "weak" again.

Seems like it should either stick at "strong", or bounce back to "super
strong", "insanely strong", etc.

—
Reply to this email directly or view it on GitHub
#1.

from mitro.

(so that "this is great passwor" is treated as better than "this is great
password").

Happy to accept suggestions for a better algorithm.

On Thu, Jul 31, 2014 at 12:17 PM, Vijay Pandurangan [email protected] wrote:

There is a bloom filter of a bunch of common passwords. If any word on the
common password list appears, it penalizes it, see:
https://github.com/mitro-co/mitro/blob/master/browser-ext/login/frontend/static/js/passwords.js

On Thu, Jul 31, 2014 at 12:15 PM, Peter Eckersley <
[email protected]> wrote:

As you type a really strong password, the strength indicator goes up to
"strong" and then bounces back down to "weak" again.

Seems like it should either stick at "strong", or bounce back to "super
strong", "insanely strong", etc.

—
Reply to this email directly or view it on GitHub
#1.

from mitro.

The bloom filter idea there is pretty neat.

If you need a recommendation, https://github.com/dropbox/zxcvbn is a good library.

from mitro.

The bloom filter idea is not a bad one, it's just that the password strength measure should incorporate it in an entropy estimation model. For instance, if I start with this password:

pree!7fixee

it's labelled "good" ; but if I add an extra word on the end

pree!7fixeething

it becomes weak. In fact it's clearly a stronger password. The right way to do this is probably to estimate the entropy contributed by each character in the password (less if that character is in a dictionary word, more if it's not). zxcvbn seems to do this decently well, so we should probably just use it.

from mitro.

Yeah, this is a very good point.

On Fri, Aug 1, 2014 at 7:54 PM, Peter Eckersley [email protected]
wrote:

The bloom filter idea is not a bad one, it's just that the password
strength measure should incorporate it in an entropy estimation model. For
instance, if I start with this password:

pree!7fixee

it's labelled "good" ; but if I add an extra word on the end

pree!7fixee_thing_

it becomes weak. In fact it's clearly a stronger password. The right way
to do this is probably to estimate the entropy contributed by each
character in the password (less if that character is in a dictionary word,
more if it's not). zxcvbn seems to do this decently well
https://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.html, so we
should probably just use it.

—
Reply to this email directly or view it on GitHub
#1 (comment).

from mitro.