Overestimates cardinality for bruteforce substrings when other types of characters present elsewhere about zxcvbn

[lowe]

Good point about this pattern:

...bruteforce-pattern-bruteforce...

e.g.

frzplfqetuothvpasswordf2r3z

Right now zxcvbn calculates a single cardinality over the full password, and uses it in the entropy math of each bruteforce region. Instead, it should do the cardinality math for each region independently. We're in agreement there, and i'll keep this issue open until I fix it.

Your second point about two adjacent bruteforce regions:

...bruteforce-bruteforce...

e.g.

frzplfqFRZPLFQ

I'd tend to agree except it starts to get weird with cases like:

fRZplf39s9

Is RZ a single region? s? 39?

Also, zxcvbn will never match two brute force regions that are adjacent -- it'll always match them as a single larger bruteforce region. This is because bruteforce is the default "pattern", when none of the other patterns fit.

So I don't think I'll change the way bruteforce is calculated for frzplfqetuothvCOCIWDZOAZPVRL. Sound like a good compromise?

Thanks for reporting!
Dan

[lowe]

This is now fixed. Cardinality for bruteforce matches is now 10 across the board, independent of types of characters present.

One thing is for sure -- earlier cardinality estimates were way too high. A markov attack, for example, could significantly reduce the number of tries needed per character if the password is "english word-like" [common consonant-vowel sequences] or "password-like" [starts with capital letters, lowers in the middle, ends with numbers].

It would be a fun future research project to investigate better models for estimating resistance to markov attacks / other "smart" bruteforce attacks on a given password, perhaps trained on a large password corpus. For now this is a simple fix in the right direction.

One downside is this significantly underestimates the guessability of long random strings. A random alphanumeric string will get estimated as 10^n instead of 62^n, for example. Yet another case of underestimating to be safe.