Issues with Passwords saying they're strong when comparing them to others that arent.

dropbox / zxcvbn

Low-Budget Password Strength Estimation

https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/wheeler

MIT License

15.05k stars 936 forks source link

Issues with Passwords saying they're strong when comparing them to others that arent. #89

Closed kingfishercreative closed 9 years ago

kingfishercreative commented 9 years ago

Hi,

I'm not sure if this is an issue or just interesting. However if a password is: aAaAaAaAaAaAaAaAaAaAa it's considered strong where as abC12!23456789123456 isn't strong. Can you confirm that this is working correctly to display that the first password is stronger than the second?

bmurray commented 9 years ago

I submitted a pull request #65 that addresses this problem. It probably needs to be updated for the current release tho.

lowe commented 9 years ago

thanks for posting, this is one of the biggest problems with zxcvbn (lack of multi-character repeat detection) and a fix is coming soon after i finish unit tests + code coverage. will keep open until it's fixed.

lowe commented 9 years ago

This is fixed in 3.5.0 -- 'aAaAaA' is recognized as a multi-character repeat string. See the new impl of repeat_match to see how it works.