A wide range of # reasonable numbers anywhere from one billion - one trillion # guesses per second, depending on number of cores and machines. # offline attack with user-unique salting but a fast hash # function like SHA-1, SHA-256 or MD5. assumes multiple attackers, # proper user-unique salting, and a slow hash function # w/ moderate work factor, such as bcrypt, scrypt, PBKDF2. # online attack on a service that doesn't ratelimit, # or where an attacker has outsmarted ratelimiting. # online attack on a service that ratelimits password auth attempts. crack_times_seconds # dictionary of back-of-the-envelope crack time # estimations, in seconds, based on a few scenarios: guesses_log10 # order of magnitude of result.guesses result. guesses # estimated guesses needed to crack password result. Install node and bower if you haven't already. In the absence of those, it adds a single function zxcvbn() to the global namespace. Zxcvbn detects and supports CommonJS (node, browserify) and AMD (RequireJS).
If JavaScript doesn't work for you, others have graciously ported the library to these languages: In addition to strength estimation, zxcvbn includes minimal, targeted verbal feedback that can help guide users towards less guessable passwords.įor further detail and motivation, please refer to the USENIX Security '16 paper and presentation.Īt Dropbox we use zxcvbn ( Release notes) on our web, desktop, iOS and Android clients.
0 kommentar(er)
