Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

A problem with zxcvbn fails badly at passphrase evaluation - for example it will claim "all your base are belong to us" would take centuries to crack.


I assume you mean "it's long but a commonly chosen long password"

Do you have evidence that is a commonly used password? I'm genuinely curious. The people geeky enough to know that meme might be slightly more likely to understand why it's a poor choice of password.


It was just a random example, but a couple years ago I found 250 BTC with a private key of sha256("how much wood could a woodchuck chuck if a woodchuck could chuck wood"). People use quotes from movies/tv/books/etc for stuff that matters.


Still better than most other password quality checkers.

In a sense, they can all only tell you that something is certainly a bad password, or maybe a good one. It's a very hard problem, and zxcvbn does a much better job than most (more naive) tools.


It estimates 79.6 bits of entropy. It's basing the estimate on just the words, not on the popularity of the phrase as a whole.

Let's compare that to https://www.grc.com/haystack.htm which many people promote as a good password checker, but is actually terrible. It claims 177 bits of entropy. This is basing the estimate on just the individual characters.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: