search

palant / pfp

A simple and secure browser extension to be used with KeePass databases.
https://pfp.works/
Mozilla Public License 2.0
113 stars 14 forks source link

Master password security guidelines #62

Closed ghost closed 6 years ago

ghost commented 6 years ago

Recently similar solution was posted on reddit [1] and many people were concerned about master password security [2]. There is a question about how strong master password have to be and how users will know if it's secure enough.

I wonder if easypasswords can implement something like password entropy meter [3]. Alternatively it can document password security guidelines or link to something already available.

[1] https://medium.com/@cretezy/masterpassx-a-better-stateless-password-generator-a06b93b9aa8c [2] https://www.reddit.com/r/netsec/comments/7mymqw/masterpassx_a_better_stateless_password_generator/drxp1dd/ [3] https://ae7.st/g/test.html https://apps.cygnius.net/passtest/ https://blogs.dropbox.com/tech/2012/04/zxcvbn-realistic-password-strength-estimation/ https://github.com/dropbox/zxcvbn

BTW: author of a mentioned solution answered to your previous concerns https://www.reddit.com/r/programming/comments/7myfjg/masterpassx_a_better_stateless_password_generator/drya603/

palant commented 6 years ago

This password entropy meter is using zxcvbn library which is exactly what Easy Passwords is using as well. Easy Password is merely presenting the results differently, in a way that is easier to interpret than a number of bits. Also, Easy Passwords has other expectations: any password getting zxcvbn score 3 (corresponds to around 26 bits) or higher is considered good enough, even though score 4 (corresponds to around 33 bits) is clearly preferable. In general, expecting humans to remember passwords with more than 40 bits of entropy is unrealistic, and we should improve the hashing function instead. The "safe" 70 bits are only relevant with a horribly crappy hashing function (cracking within a year requires testing 38,000 billion guesses per second).

Any objections against resolving this as "worksforme"?

ghost commented 6 years ago

Sorry, I didn't check what easypasswords already do. Is there a reason why zxcvbn version is hardcoded to 4.3.0 https://github.com/palant/easypasswords/blob/master/data/panel/panel.html#L12 ?

Anyway this can be closed

palant commented 6 years ago

It's not hardcoded, this is merely the file name of the version we currently use. I keep the version number in the file name so that AMO reviewers don't need to track it down. But - sure, we should update zxcvbn.

palant commented 6 years ago

For reference, there is now an article under https://pfp.works/documentation/choosing-master-password/ on the topic, linked when you set a master password.