search

dropbox / zxcvbn

Low-Budget Password Strength Estimation
https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/wheeler
MIT License
14.87k stars 931 forks source link

Evaluate to create a minified version that do not implement check on frequency list #268

Open evilaliv3 opened 4 years ago

evilaliv3 commented 4 years ago

I just found out that 90% of the library size is represented by the frequency lists.

I wonder if it would be useful to create a version of the library that do not implement checks on the frequency list (that is anyhow based on english words).

This would make it possible to reuce the sice of the library from ~900kb to ~100kb

evilaliv3 commented 4 years ago

@lowe what do you think?

In the scope of GlobaLeaks for example this would be helpful as we have an application of 2MB where 900kb are need just for the zxcvbn library. And as the project is not only focused on english, the check is even not that important.

evilaliv3 commented 4 years ago

It is true actually that the check performed by the library is based on dictionaries and permutations but it would be actually worth it to analyze how to optimize this in relation for example to the possibility to load dinamically different dictionaries]

tracker1 commented 4 years ago

@evilaliv3 There are a couple async loaders for this library, asdfgh is one, I don't recall the other. That may help with not loading this on pages you don't need it on. Also, if you happen to be running node or another platform supported by a port, you may want to defer the zxcvbn check to a server call, or websocket request even. Assuming your latency is relatively small.

evilaliv3 commented 4 years ago

Thank you @tracker1 !