bartificer / xkpasswd-js

The official JavaScript port of the Crypt::HSXKPasswd Perl module.
https://bartificer.github.io/xkpasswd-js/
BSD 2-Clause "Simplified" License
62 stars 11 forks source link

Only one 12 letter word #97

Open westbaystars opened 4 months ago

westbaystars commented 4 months ago

There appears to be only one 12 letter word: "considerable."

Set the Min Length and Max Length to 12 letters and after many tries, the only resulting word is "Considerable."

%%50$Considerable$Considerable$Considerable$44%%
__97%Considerable%Considerable%Considerable%65__
**88?Considerable?Considerable?Considerable?12**

Either more 12 letter words need to be added or 11 should be the maximum word size.

11 letters also seem to be the same five words as well, though: Temperature, Information, Electricity, Instruments, Netherlands.

del-leehopper commented 4 months ago

It's a good point.

The word list is here: https://github.com/bartificer/xkpasswd-js/blob/main/src/lib/dictionaryEN.mjs

I've always wondered how this list was generated. I've always wanted to expand it, but I can understand why you might not (e.g. because certain words might have NSFW meanings or be too obscure for people to know what the word is and remember it).

westbaystars commented 4 months ago

Blind entropy is still good, especially when you have a range of potential word lengths.

Looking at the "Statistics" box, the calculated "full knowledge" bits appear to be the problem. So if one knows that the password was generated with this tool with words 11 characters long, that is consistently 29 bits of entropy, which one wants to be above 52 bits (according to the information box).

del-leehopper commented 4 months ago

Just FYI, I think the entropy calculation wasn't accurate from the last time I saw it. I'm not sure if someone has fixed it yet, so check out the issues to be sure.

hepabolu commented 3 months ago

The dictionary was taken straight out of the old Perl code. I had also already noted the single 12-letter word, but I haven't investigate further, because I was focusing on other functionality. I want to look into this further when work starts on adding multiple dictionaries.

westbaystars commented 3 months ago

No worries. This seems like a very low priority. Most of the presets deal with words between 4 and 8 (inclusive) characters in length.