DOS Exploit

[Tostino]

Hey, just wanted to let you know I've gotten reports from users of my library: Nbvcxz that are getting a DOS every so often by specifically crafted passwords.

I even found a tool created by a government contractor used for issuing a DOS against programs using libraries containing the vulnerable (to combination explosion) algorithms from the original zxcvbn implementation:

• https://github.com/twosixlabs/acsploit
• https://github.com/GoSimpleLLC/nbvcxz/issues/60

I've solved this by implementing a maxLength type configuration...but that isn't totally done yet as I feel like I still need to have it do dictionary checks against the full-length password without any transformations. Working on finishing that feature and putting out a release. I just wanted to mention it to you, since this is also often run server-side rather than client-side.

[vvatanabe]

If you are worried about DOS then just limit the password length to a few hundred characters. （We are not rejecting the approach of setting a maximum number of characters.）

[luc-x41]

I have not looked at the specific regexes used, but note that limiting to a few hundred characters is typically not a solution for ReDoS vulnerabilities. Taking the class name regex example from Wikipedia, 36 characters takes nearly a full second to match for me. Submitting more than one request per second is possible on any data connection, which would lead to the server becoming overloaded because that rate is faster than the server can match against such a regex.

[bowbahdoe]

@Tostino @vvatanabe Is this still an issue/something to be worried about? What is the magnitude of the issue here?