search

zxcvbn-ts / zxcvbn

Low-Budget Password Strength Estimation
https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/wheeler
MIT License
907 stars 72 forks source link

Improving userInputs dictionnary feedback #52

Closed paulverbeke closed 3 years ago

paulverbeke commented 3 years ago

Hi, First of all thanks a lot for this work. The original Dropbox library desperately needed maintenance.

I saw that french translations were recently added by someone, in looking into this I noticed that, no matter the language, the only feedback given when password contains an entry from the userInputs dictionary is 'There should not be any personal data.'. Based on the original library documentation, this dictionary should also be used for site-specific vocabulary, so can I suggest that this feedback be changed to something more representative of what the dev is likely to have added, in the line of "There should not be any personal data or forbidden/banned words", or just a more general feedback ?

I can take care of updating french translations if needed.

Thanks !

Originally posted by @paulverbeke in https://github.com/zxcvbn-ts/zxcvbn/issues/36#issuecomment-844738592

paulverbeke commented 3 years ago

Could we just list every forbidden words ? "There should not be any of these words: [...]" and enumerating userInputs list. Could be problematic if long list. Or maybe leave a specific tag that could be easily replaced by the dev implementing zxcvbn. That way the dev is in total control of the list showed in feedback, and may only show a smaller subset of a really long list.

MrWook commented 3 years ago

The list would be pretty weird and can get pretty quick out of hand. The dev already has full control of what is shown as feedback, as you can just edit the array of it:

import zxcvbnEnPackage from '@zxcvbn-ts/language-en'

const translations = zxcvbnEnPackage.translations
translations.warnings.userInputs = 'Your custom feedback for userInputs'

How about something like There should not be any personal or page related data.?

paulverbeke commented 3 years ago

oh great, didn't realize you could override. In this case yes the feedback is definitely better like this. I would emphasize something like "service" or "site" instead of "page"

MrWook commented 3 years ago

You can override most of the stuff that was my goal. Let's stick with site. Which means we have those translations:

en: There should not be any personal or page related data.

de: Es sollten keine persönlichen oder Seiten relevanten Daten vorkommen.

fr: Your translation

nl-be: @SimonBackx do you mind helping us out?

hrueger commented 3 years ago

I believe that the en one should then be There should not be any personal or site related data. and for the de version I'd go with Es sollten keine persönlichen oder seitenrelevanten Daten vorkommen. 😀

paulverbeke commented 3 years ago

Great, for the fr part that should be: Le mot de passe ne doit pas comporter de données personnelles ou liées au site.

MrWook commented 3 years ago

Do you mind creating a PR for it? Since Simon does not answer we can just use something like deepl for nl-be and someone can improve it later. This way we can get this issue rolling 👍

SimonBackx commented 3 years ago

Vermijd persoonlijke of website gerelateerde woorden.

Is the Dutch one, sorry for the delay!