search

roddhjav / pass-audit

A pass extension for auditing your password repository.
https://www.passwordstore.org/
GNU General Public License v3.0
93 stars 18 forks source link

Request for clarificaiton why pass audit is detecting a Weak Password (dictionary) #30

Open andrewklajman opened 1 year ago

andrewklajman commented 1 year ago

Hi @roddhjav ,

I wanted to say that pass audit is a great extension to pass.

Im not sure if you review these issues or if this is even an appropriate question but i thought I would ask anyway.

I ran pass audit and found a few of my passwords are raised as a Weak password (dictionary). An example is the one below (this is from a defuct account). w Weak password detected: rxed5Q^$J2Sq from Games/EveOnline might be weak. Score 0 (461 guesses). This estimate is based on the sequence rxed5Q^$J2Sq(dictionary)

I understand that pass audit is just passing the password to hibp to evaluate it. But when I go to the hibp web portal, to the passwords section and check the password rxed5Q^$J2Sq its says 'no pwnage found'

Im not sure if I am missing something or if you can explain this difference?

Thanks

roddhjav commented 1 year ago

Password are checked against hibp and zxcvbn. This detection is due to zxcvbn not hibp.