zxcvbn-ts / zxcvbn

Low-Budget Password Strength Estimation
https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/wheeler
MIT License
858 stars 68 forks source link

Improve documentation #268

Open MrWook opened 1 month ago

MrWook commented 1 month ago

As @karlhorky suggested we need to improve the documentation for common pitfalls. Some ideas:

  1. How to manually merge dictionaries safely (currently seems pretty hazardous because of the nested config data shape and potential for object key naming collisions)
  2. How to add custom words to dictionaries easily (and where in the object structure to put them). For example, probably every website should include their website name, URL, brand and variations thereof, because common password patterns include adding the name of the service to the password, which is highly insecure.
  3. "what should I do if I have an array that overlaps heavily with another array?"
  4. "should I pre-process my overlapping arrays (eg. remove duplicates as in 1) before I add them to dictionaries?"
  5. "what are the performance or other implications of adding a large dataset to dictionaries? is there a better way to add data to be more performant?"
  6. "will I receive runtime errors (other than type errors) if there is some kind of collision or I add data that is incompatible in some way?"
  7. a different section in the docs, entitled something like "Filtering custom words"
  8. I would recommend top-level, because it seems like one of the first things that a user would want to do maybe below "Getting Started", or below "Languages"
  9. this new section could actually have "Filtering user input" (the current "UserInput" page) as a sub-heading
  10. Swap "Migration" and "Example" in the sidebar
  11. Best practive page