Comments (4)
The original author referred to this entropy as structural entropy, and made a documented decision to ignore it ("It’s difficult to formulate a sound model for structural entropy; statistically, I don’t happen to know what structures people choose most, so I’d rather do the safe thing and underestimate", https://tech.dropbox.com/2012/04/zxcvbn-realistic-password-strength-estimation/).
from zxcvbn.
A very simple but decent model would be to observe the frequency of all
structures across a large password dataset. If dropbox doesn't want to
do this, there are a few blog posts by people with very large password
dbs who might help.
A slightly better model would be to make the structure probabilities
conditional on the preceding structure in a given password.
Or you could go overboard and use
PPM.
Sounds like a fun project for an undergraduate thesis or an intern
somewhere :)
On Tue, Aug 12, 2014 at 12:25:22PM -0700, Björn Stein wrote:
The original author referred to this entropy as structural entropy, and made a documented decision to ignore it ("It’s difficult to formulate a sound model for structural entropy; statistically, I don’t happen to know what structures people choose most, so I’d rather do the safe thing and underestimate", https://tech.dropbox.com/2012/04/zxcvbn-realistic-password-strength-estimation/).
Reply to this email directly or view it on GitHub:
#48 (comment)
Peter Eckersley [email protected]
Technology Projects Director Tel +1 415 436 9333 x131
Electronic Frontier Foundation Fax +1 415 436 9993
from zxcvbn.
Agreed. @pde, thanks for reporting, I know it's been a while :) Extra entropy for each entry in the match sequence is coming soon. I have a simpler scheme in mind than what you propose, and will update this thread with more soon.
from zxcvbn.
After experimenting with different models over the last two weeks, a reasonable length penalty is now implemented in 4.0.1. Try it out, and check the docs in scoring.coffee to see how it works. Feedback appreciated!
from zxcvbn.
Related Issues (20)
- Password File
- Electron app
- Code security
- Bypass password File HOT 2
- Creating Electron app
- README.md
- please delete this issue
- Password entropy property HOT 1
- Very slow for certain inputs
- recent year regex is... out of date. HOT 2
- Different score for the password strength for the same string between TypeScript and Java versions HOT 5
- 密码强度检测 HOT 1
- Just saying thanks
- Dead "Dropbox Blog Post" URL at demo site
- Possible DOS when run server side
- A ReDoS vulnerability exists in matching.coffee HOT 10
- Microsoft Edge component version showing wrong HOT 1
- Feature request: provide options for smaller builds
- Recommended successors? HOT 1
- I created a pure Swift version of this - how do I get it listed here?
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from zxcvbn.