“bluegiraffeplaysball” or Make Passwords Great Again Using zxcvbn
summary
A realistic password estimator called zxcvbn breaks strings into dictionary, sequence, repeat and substitution matches, scores each match, and uses dynamic programming to find the lowest-entropy decomposition. Example: a substituted rare word like "troubadour?3" scores ~28 bits and is crackable quickly, while four common words (the bluegiraffeplaysball style) score ~44 bits (~550 years at offline rates). The library is MIT open source, <1MB of data, runs ~5–20 ms for typical lengths, ships in Python and other languages and powers Dropbox’s strength meter.
AI-written summary · about
chapters (14)
- 0:00Introduction to passwords
- 1:14Defining a good password
- 3:47Password entropy and security
- 6:48Realistic password estimation
- 8:38Pattern based attacks
- 10:51The zxcvbn library
- 12:14Zxcvbn origins
- 13:36How zxcvbn works
- 17:25Dynamic programming approach
- 19:17Library performance and usage
- 21:20Implementing security in Dropbox
- 22:55Challenges and limitations
- 23:37Fun with tech
- 24:50Q&A and closing
related talks
32mzxcvbn: Low-Budget Password Strength Estimation
30mhunter2: A Symphony of Password Horror
28mRandom Passwords Aren't Good Enough
23mFantastic Passwords and Where to Find Them
43mPlease pass the salt: Serve up passwords with a side of entropy
40mFantastic Passwords and Where to Find Them
34m80,00 Plaintext Passwords
14mPasswords. Are. Not. Hard!