Comments (17)
I'm also having this issue (on Slack)
from zxcvbn.
@ChicagoSchooler; Are you saying that a solution that does not check passwords more than N characters long is a good solution? If so, what is a suitable threshold value for N
?
from zxcvbn.
@ChicagoSchooler; Thank you for response. I think I understood most of it. Unfortunately it does not seem to answer any of the questions in the original post. (I agree it is a WP problem. That is not the question.)
from zxcvbn.
The browser being unresponsive for long passwords is due to zxcvbn blocking until calculation is done, which is a problem with zxcvbn, not WordPress.
from zxcvbn.
Using Web Workers is a great idea. Thank you @ChicagoSchooler! π
Is this a feature that could be built into zxcvbn? Would the maintainers like such a feature?
Would you mind elaborating how using zxcvbn only on the first 32 characters would make it less effective?
I understand that it is pointless for serious passwords. zxcvbn currently works well for both serious and not-serious passwords, reflecting the strength of each. Is that likely to change?
from zxcvbn.
Thanks @ChicagoSchooler.
I would be interested in the opinion of the maintainer about whether a Web Workers feature would be a welcome contribution.
Another idea occurred to me; What if zxcvbn stopped checking more characters after a sufficiently high entropy was reached? In otherwords, set a threshold of an entropy level instead of a character limit. (Though I still think Web Workers is probably a better solution.)
from zxcvbn.
Hey @BevanR , maintainer here. Unfortunately I haven't been able to dedicate much time to zxcvbn upkeep (planning to make some improvements soon when I can dedicate a larger block of time -- stay tuned!).
In terms of whether it's a reasonable ask for zxcvbn to process a 500-char password efficiently -- absolutely! I'll keep it on my list of things to do, and will be thinking about simpler ways to give good but efficient strength estimation for longer passwords.
Using Web Workers seems like overkill to me at first glance -- zxcvbn is meant to give immediate, preferably sub-perceptive feedback. It seems to me a sufficient solution is to speed up the core function for long inputs.
In the meantime I'd use a simple workaround -- only passing say the first ~50-75 characters to zxcvbn would eliminate your efficiency concern and only yield inaccuracies in rare corners (eg first 75+ characters are a simple repeat, the rest is more complex.) Also note that only evaluating the first 75 chars will except in extremely rare corner cases never overestimate the entropy*, just underestimate -- this could erroneously send the message "you need a better password" when in fact the megapassword has plenty of complexity in its suffix, but it won't incorrectly tell the user that their password is great, which I consider worse.
* only exception i can think of is a long dictionary word that ends somewhere after the 75-char boundary, a tiny corner case.
from zxcvbn.
Thank you for your thoughts @lowe.
How to you determine a threshold of 50-75 characters? What are the benefits (for WP) of lowering or raising this threshold?
The longest words likely to be found in any normal English dictionary are all much less than 75 characters. See Longest word in English on Wikipedia
As for other languages, this Wikipedia article on Longest words documents quite well that languages known to have longer words are all compound words with many components. Such words would not be found in any regular dictionary for those languages.
The only exceptions are Icelandic and Maori which have place names that are 64 characters 85 characters long respectively. I think these exceptions are so few for a threshold of around 70 characters that they are probably acceptable. WDYT?
from zxcvbn.
Hey @BevanR ,
The threshold should be determined by what sort of performance bound you're looking for. I think 75 is the right ballpark, you'd probably be fine at 100 as well.
On my 2.6 GHz Intel Core i7 running the latest version of Chrome, zxcvbn takes around ~15 milliseconds for 75-char base 62 strings. Anything under 100 ms is totally acceptable imo -- what I don't know is how slowly zxcvbn runs on other setups...someone please let me know what OS/CPU/browser if they observe 100ms+ runtimes for 75-char inputs.
To get a quick ballpark you can try running in your browser console:
var start = new Date().getTime();
zxcvbn('zRqeSxuyg9pnMHCkV{iktT,pCdE7scUcjcLQnLmqLm#VtHLKYb,pCdE7scUcjcLQnLmqLmCVtHL');
var end = new Date().getTime();
end - start; // milliseconds
re: Maori -- I wouldn't worry about these corner cases unless you've seen cracker lists that check against them or better yet cracked passwords that include them. Not likely in the case of 85-char Maori place names!
from zxcvbn.
ps. while not the greatest password, "taumatawhakatangihangakoauauotamateaturipukakapikimaungahoronukupokaiwhenuakitanatahu" would be a fantastic user name. distinctive, memorable!
from zxcvbn.
Great! Thanks @lowe. I will suggest WP moves forward with a solution that only inspects the first ~75 characters for now.
On Chrome on Mac OS X 10.8.5 with 1.3GHz i5 I got 25-40ms for that test script.
from zxcvbn.
I submitted a patch to the WP core issue queue that limits the strength check to the first 128 characters. (FYI only.)
from zxcvbn.
Thanks @BevanR , closing this out.
from zxcvbn.
@lowe has this issue actually been fixed?
I'm still getting this error in Firefox:
Warning: Unresponsive script
A script on this page may be busy, or it may have stopped responding. You can stop the script now, open the script in the debugger, or let the script continue.Script: zxcvbn:2
from zxcvbn.
Hi @jomo, are you reproducing this according to WP issue 31772?? Or do you have other steps?
I closed this issue thinking every user of zxcvbn will have their own performance bounds, therefore it shouldn't be the lib's responsibility to automatically cut off after N characters, let clients (eg wordpress) do that.
But given zxcvbn runs well on ~100-200 characters, more than the vast majority of passwords, it'd be reasonable to add a cutoff inside the lib. Let me sleep on it.
from zxcvbn.
Nothing related to WP.
zxcvbn runs well on ~100-200 characters
I just tried the latest version with a 200 character password. It made Firefox hang for a couple seconds and then:
My password manager has a slider going up to 256 characters, I just use that (because why not?).
I've been very annoyed on sites that use zxcvbn due to FF being unresponsive for a long time.
How about cutting passwords off at 100 characters by default, but allow changing that?
I think 100 characters is a good limit because I had ~500ms of calc time in FF, which is acceptable.
e.g.:
zxcvbn("secret"); // use default of 100 characters
zxcvbn("secret", {limit: null}); // unlimited
zxcvbn("secret", {limit: 256}); // 256 characters
from zxcvbn.
Would it be possible to run for each 64characters, overlapping at 32... so first would be 0-63, then 32-95, 64-127, etc.. stopping at whatever feels good, would think getting the first 128 characters in 4 passes may be more efficient than trying to get it all in one.
Alternatively, NIST's new guidelines suggest if you have a password limit, it be at least 64 characters, so maybe advising users to trim/limit at 128, and use that in any case may be a good idea.
from zxcvbn.
Related Issues (20)
- Password File
- Electron app
- Code security
- Bypass password File HOT 2
- Creating Electron app
- README.md
- please delete this issue
- Password entropy property HOT 1
- Very slow for certain inputs
- recent year regex is... out of date. HOT 2
- Different score for the password strength for the same string between TypeScript and Java versions HOT 5
- ε―η εΌΊεΊ¦ζ£ζ΅ HOT 1
- Just saying thanks
- Dead "Dropbox Blog Post" URL at demo site
- Possible DOS when run server side
- A ReDoS vulnerability exists in matching.coffee HOT 10
- Microsoft Edge component version showing wrong HOT 1
- Feature request: provide options for smaller builds
- Recommended successors? HOT 1
- I created a pure Swift version of this - how do I get it listed here?
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
π Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. πππ
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google β€οΈ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from zxcvbn.