phonetic alphabet should be tested about zxcvbn

[pyramids]

+1

Fixing would require first including the phonetic (or ICAO or NATO or whatever your favorite community calls it) alphabet, which begs the question: Whilst we're at it, what other spelling alphabets should get included?

[fortran77]

I'll follow up (over a year later) by suggesting that, even at the risk of causing some false hits, whenever the string formed by taking the first letter of each of a sequence of words can itself be found in a weak-password dictionary, then the entire test string should marked as not strong. So any sequence of words whose first letters form some recognizable string (like abcd, egbdf, sohcahtoa, csgtl) would be considered weak.

[lowe]

I think the right solution is to allow custom dictionaries, such that those that want to match the phonetic alphabet can add it to their bundle of dictionaries. custom dictionaries, keyboard layouts, and other internationalization features are on my roadmap.

i haven't seen many passwords that use the phonetic alphabet, or password crackers that iterate through ICAO/NATO instead of top password / english dicts, but if there's evidence to the contrary, it would make sense to include into the default dicts / matching.