dropbox/zxcvbn on Hacker News

…unacceptable minimum. Because you can compute it client-side, you can give real-time feedback. [0] https://github.com/dropbox/zxcvbn

comment by jszymborski · 2024-10-18 · in Apple Passwords’ generated strong password format

…time, score, and gives feedback based on the password. imo it's a pretty good ux if used right [0]: https://github.com/dropbox/zxcvbn

comment by compootr · 2024-08-18 · in Flaw has Microsoft Authenticator overwriting MFA accounts, locking users out

…hashes to the database) 1: https://dropbox.tech/security/zxcvbn-realistic-password-stre... 2: https://github.com/dropbox/zxcvbn

comment by stephenr · 2024-01-18 · in Show HN: A lightweight PHP library for checking password strength

> except for ZXCVBN You mean the Low-Budget Password Strength Estimator? https://github.com/dropbox/zxcvbn Yeah, that name is totally legit.

comment by sshine · 2023-02-17 · in TIL There's Another YAML

…all this song and dance around key stretching iterations. 1 - https://github.com/envkey/envkey 2 - https://github.com/dropbox/zxcvbn

comment by danenania · 2023-01-24 · in Bitwarden design flaw: Server side iterations

…I might also make a future blog post targeting developers. In the meantime, here's some cool stuff: https://github.com/dropbox/zxcvbn - A reasonable approach to password strength estimation (although I think their calculation needs…

comment by some_furry · 2023-01-07 · in What We Do in the /etc/shadow – Cryptography with Passwords

The author links to a recommended library in the blog post https://github.com/dropbox/zxcvbn

comment by chadlavi · 2022-12-23 · in Password Requirements: Myths and Madness

…well known sequences (123, zxcvbn). Check out the great password entropy checker called zxcvbn: https://github.com/dropbox/zxcvbn https://dropbox.tech/security/zxcvbn-realistic-password-stre... https://www.bennish.net/password-strength-chec…

comment by FabHK · 2022-04-04 · in The Personal Security Checklist

…password on all sites is now "correct horse battery staple". Inspired by this, there's a package https://github.com/dropbox/zxcvbn to estimate entropy and give suggestions.

comment by voiper1 · 2022-01-17 · in Entropy isn't sufficient to measure password strength

…ones using outdated and hurtful policies like requiring numbers and special characters. [1] https://github.com/dropbox/zxcvbn

comment by ascar · 2021-08-11 · in Please log in with router's password

When implementing a password strength checker lately I relied mainly on https://github.com/dropbox/zxcvbn (which is great) but added in a check for correct horse battery staple (and variants). Probably not that important in the big scheme…

comment by gmac · 2021-08-07 · in The logic behind three random words

…also the motivation for zxcvbn, the open source library chrome uses to evaluate password strength! https://github.com/dropbox/zxcvbn

comment by Godel_unicode · 2020-12-13 · in Show HN: Entropy Based Password Validation

We already have zxcvbn https://github.com/dropbox/zxcvbn

comment by Thorrez · 2019-11-15 · in In Its First Funding in 14 Years, 1Password Raises $200M Series A

obligatory thread naming good open-source password entropy checkers. I'll start. zxcvbn: https://github.com/dropbox/zxcvbn

comment by steindavidb · 2019-09-05 · in Sites with dumb password rules

…https://pages.nist.gov/800-63-3/sp800-63b.html [2] https://spycloud.com/new-nist-guidelines/ [3] https://github.com/dropbox/zxcvbn

comment by ecesena · 2019-08-03 · in Ask HN: What are some guidelines for good passwords

…switching to the haveibeenpwned API[1] or zxcvbn[2]. [1]: https://haveibeenpwned.com/API/v2 [2]: https://github.com/dropbox/zxcvbn

comment by cyphar · 2019-07-07 · in Strong_password Rubygem hijacked

Also this, which references the same comic: https://github.com/dropbox/zxcvbn

comment by josefresco · 2018-12-06 · in Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

I like this entropy based password strength checker: https://github.com/dropbox/zxcvbn Here you can see that it realizes that all your passwords are weak: https://lowe.github.io/tryzxcvbn/ (it says: cracked in minutes, or seconds, in an…

comment by KajMagnus · 2018-05-03 · in 86% of CrashCrate subscribers used passwords already leaked in other breaches

…zxcvbn[1] seems to do a good job of this along with detecting sequences and keyboard patterns. [1] https://github.com/dropbox/zxcvbn

comment by kbirkeland · 2018-04-30 · in Show HN: How Secure Is My Password

…like zxcvbn) For reference, these are the passwords and common words zxcvbn already checks against: https://github.com/dropbox/zxcvbn/tree/master/data And with zxcvbn it'll still flag a password as low entropy/low security if the password…

comment by varenc · 2018-02-22 · in "Pwned Passwords" V2 With Half a Billion Passwords

…a password manager). Instead: 1. Use a high-level password-strength assessment widget like zxcvbn: https://github.com/dropbox/zxcvbn 2. Configure a blacklist with, say, 10K or 20K of the most common passwords. 3. Hash passwords with bcrypt…

comment by royce · 2018-02-22 · in "Pwned Passwords" V2 With Half a Billion Passwords

It makes sense as an approach – Dropbox open-sourced a library along these lines, called zxcvbn: https://github.com/dropbox/zxcvbn

comment by ryantownsend · 2018-02-06 · in How Long Is Long Enough? Minimum Password Lengths by the World's Top Sites

See also: https://github.com/dropbox/zxcvbn (I'm not connected or affiliated with Dropbox or this project.)

comment by petecooper · 2018-02-06 · in How Long Is Long Enough? Minimum Password Lengths by the World's Top Sites

This is excellent advice and zxcvbn [1] looks awesome. [1] https://github.com/dropbox/zxcvbn

comment by andy_ppp · 2018-02-04 · in Safari Password Generation

…strength meter using zxcvbn[1]. For example: https://github.com/MorrisJobke/strengthify [1]: https://github.com/dropbox/zxcvbn

comment by welder · 2017-07-26 · in Passwords Evolved: Authentication Guidance for the Modern Era

Dropbox has their zxcvbn method which incorporates a list of 30k of the most common passwords https://github.com/dropbox/zxcvbn

comment by berzerk0 · 2017-06-12 · in Show HN: 5+ Billion Passwords in Order of Most Popular

I wonder if Jeff and his team know about Dropbox's password strength estimator: https://github.com/dropbox/zxcvbn

comment by mwcampbell · 2017-06-02 · in Hacker, Hack Thyself

zxcvbn is a library by Dropbox that makes a fairly realistic sort of password strength estimate. [1]: https://github.com/dropbox/zxcvbn

comment by chrismorgan · 2017-03-10 · in Password Rules Are Bullshit

This is naturally due to having large-ish dictionaries embedded: https://github.com/dropbox/zxcvbn/tree/master/data Some people in the thread you linked to recommend lazy loading, another idea would be to use a bloom filter – I used this…

comment by smnscu · 2017-02-18 · in Show HN: Evilpass – A slightly evil password strength checker

…React/Redux app and it was about the same size as everything else combined. Edit: 832kb apparently https://github.com/dropbox/zxcvbn/issues/169

comment by rohannair · 2017-02-18 · in Show HN: Evilpass – A slightly evil password strength checker

An actually-useful alternative: https://github.com/dropbox/zxcvbn

comment by bjt · 2017-02-18 · in Show HN: Evilpass – A slightly evil password strength checker

…getting rid of arbitrary requirements focused more on SQL injection than password safety.) [1] https://github.com/dropbox/zxcvbn

comment by jonafato · 2017-02-18 · in Show HN: Evilpass – A slightly evil password strength checker

…the extra server-side criteria. It seems to be working nicely. Educate, don't infuriate. :) [0]: https://github.com/dropbox/zxcvbn

comment by ezekg · 2017-02-09 · in Why don't password input screens include the site's password criteria?

Repository: https://github.com/dropbox/zxcvbn

comment by brudgers · 2016-07-22 · in Realistic password strength estimation

…I keep saying in this thread, the excellent client-side password strength checking library zxcvbn ( https://github.com/dropbox/zxcvbn ) is under 400 kB compressed including dictionaries, checking against "30k common passwords, common names…

comment by FabHK · 2016-06-29 · in Ebay posts every character a user types into the password box

…[1] (developed by an engineer at Dropbox) is 400 kB (compressed) including dictionaries. [1] https://github.com/dropbox/zxcvbn

comment by FabHK · 2016-06-29 · in Ebay posts every character a user types into the password box

…c.hasErrors = !0, c.errors = [{ message: "Invalid symbols in password" }] Maybe they could've used https://github.com/dropbox/zxcvbn to determine password strength.

comment by 0xmohit · 2016-06-29 · in Show HN: Wallarm – Protect your web apps or APIs with fast Nginx-based instances

https://github.com/dropbox/zxcvbn

comment by tnorthcutt · 2016-06-29 · in Ebay posts every character a user types into the password box

…less tolerant of low-security ones. In terms of estimating security, you can use something like https://github.com/dropbox/zxcvbn which does a pretty good job of evaluating entropy and resistance to brute force attacks. Ultimately, a…

comment by morgante · 2016-06-26 · in The “Cobra Effect” that is disabling paste on password fields

For a mathematically rigorous password strength meter library, check out zxcvbn: http://github.com/dropbox/zxcvbn

comment by saynsedit · 2016-06-26 · in The “Cobra Effect” that is disabling paste on password fields

…Passwrdr.crack_time = result['crack_times_seconds']['online_no_throttling_10_per_second']; [1] https://github.com/dropbox/zxcvbn

comment by ufo · 2016-05-19 · in LinkedIn password leak

…and depends on many heuristics so I don't think it would be ideal for a password standard. [1] https://github.com/dropbox/zxcvbn

comment by ufo · 2016-02-18 · in Acceptance of FIDO 2.0 accelerates the movement to end passwords

Dropbox open-sourced a realistic password estimator called zxcvbn which is excellent; https://github.com/dropbox/zxcvbn

comment by wgx · 2016-01-19 · in 25 Most Common Passwords of 2015

Use https://github.com/dropbox/zxcvbn .

comment by bjt · 2015-12-31 · in The “Chad” bug

Abstract: pls use https://github.com/dropbox/zxcvbn

comment by vortico · 2015-10-24 · in Stop forcing arbitrary password rules

…much better ways to enforce this validation. Shoot me an email if you'd like any assistance. Also, https://github.com/dropbox/zxcvbn is amazing.

comment by sarciszewski · 2015-03-18 · in I Hate the News (2006)

you're thinking of Dropbox's zxcvbn [1] demo [2] [1] https://github.com/dropbox/zxcvbn [2] https://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.ht...

comment by leeoniya · 2015-02-02 · in Authentication Cheat Sheet

…Tr0ub4dour&3 344 thousand years 22 hours correcthorsebatterystaple A quintillion years 65 years [1] https://github.com/dropbox/zxcvbn

comment by dbarlett · 2015-01-15 · in “How Secure Is My Password?” Strength Meter Open Sourced

…far removed from the security provided by randomly seeded ECC keypairs. But that's not the case: https://github.com/dropbox/zxcvbn/issues/39 And as an attacker, I'm using my rainbow tables specifically to target the low hanging fruit. It…

comment by akerl_ · 2014-07-20 · in MiniLock – File encryption software that does more with less

…entropy passphrase. [0] https://github.com/kaepora/miniLock/blob/80aff2cdbcebf669fae... [1] https://github.com/dropbox/zxcvbn/issues/39 [2] https://github.com/dropbox/zxcvbn/blob/0a8b5b65a1864437eaac5...

comment by ff7c11 · 2014-07-20 · in MiniLock – File encryption software that does more with less