zxcvbn: Low-Budget Password Strength Estimation
summary
A client-side estimator called zxcvbn uses leaked-password frequency lists plus simple pattern models to rank guesses and is designed to fit into four lines of code; it runs in milliseconds and needs only 1.5 MB compressed to conservatively match state-of-the-art guessing attacks up to about 10^5 guesses (245 kB for 10^4, 29 kB for 10^3). Experiments compare against four CMU models and show near-linear accuracy in the online range, while NIST entropy gives wildly inconsistent results.
AI-written summary · about
chapters (20)
- 0:00Intro
- 2:20Verizon Wireless: Password Requirements
- 3:14Password Policy: Frozen in 1979
- 3:40Inconsistent Requirements
- 4:14Inconsistent Feedback Input: correcthorsebatterystaple
- 6:16Threat Model
- 8:09Core estimator: minimum rank over top lists Input wheeler
- 9:50Word transformations
- 10:27Keyboard patterns
- 10:50Sequence Patterns
- 13:13Outline for today
- 14:11Gold standard: PGS
- 14:54Training data
- 16:10Test data
- 20:08Estimator size?
- 21:38Minimum rank only?
- 22:28Runtime Performance
- 23:03Conclusion
- 23:39Give it a try!
- 26:41Proposal: keep UI simple
related talks
26m“bluegiraffeplaysball” or Make Passwords Great Again Using zxcvbn
19mDesign and Evaluation of a Data-Driven Password Meter
47mYour Password Complexity Requirements are Worthless
24mUsability vs. Security. Can they live together?
28mRandom Passwords Aren't Good Enough
34m80,00 Plaintext Passwords
23mFantastic Passwords and Where to Find Them
43mPlease pass the salt: Serve up passwords with a side of entropy