search

trichards57 / zxcvbn-cs

C#/.NET port of Dan Wheeler/DropBox's Zxcvbn JS password strength estimation library
MIT License
59 stars 19 forks source link

zxcvbn-cs shows different result with zxcvbn JS #21

Closed whaliim closed 3 years ago

whaliim commented 4 years ago

I am developing a .NET Web application using zxcvbn-cs (v2.1.44 from NuGet) and zxcvbn JS (Latest from their web). The problem is, they are showing different result for some case, for example password: 0vodafoneName!"

Note: badPasswordList contains "vodafone".

C# Usage: var passwordStrength = Zxcvbn.Zxcvbn.MatchPassword(pass, badPasswordList); Score: 1

JS Usage: let result = zxcvbn(password, window.badPasswordList); Score: 3

Other results (text between 0 and Name are on the badPasswordList): 0diamondName!" c# 2 js 3

0midnightName!" c# 2 js 4

0elephantName!" c# 2 js 4

How do I fix this? Is this a known issue/bug?

jonathanmadeley commented 4 years ago

I have just ran into this bug too, is there any timeline for when we should expect this to be fixed?

simondevries commented 4 years ago

Running into the same issue. The password 'Applesoranges!' gets a score of 3 on the client and 0 in C#

whaliim commented 4 years ago

One possible workaround is to use C# zxcvbn function as a WebMethod and call it from JS using AJAX call. In this case, zxcvbn JS library is not used at all and therefore the password score result is consistent.

emilmuller commented 4 years ago

and here

Koteko commented 4 years ago

We only use the C# version, but this issue seems very important as the results are not comparable with the JS results.

trichards57 commented 3 years ago

So I am working on bringing this in line with the typescript port of zxcvbn which I have also been working on for some of my own projects.

Please be aware that this is a side-project for me. I'm working through it, but it'll probably take me a little while to get things up and running properly.