represent difficulty to crack as money rather than time

https://blogs.dropbox.com/tech/2012/04/zxcvbn-realistic-password-strength-estimation/

is mostly great advice, except for one thing: using time makes a password feel much stronger.

Say, if it takes a year to crack, for most things, who could be bothered waiting that long.
It sounds pretty good! except that a year of compute is worth less than 200 bucks! (`24*365*0.02 = 170`)
You could rent 365 computers, and do this in one day.

I choose $0.02 from aws pricing, it might not be quite the right, depending on the demands of actually setting up a cloud based cracking rig, but it's probably within the ball park.

By this calculation, a century of compute is only `$17,000` I don't have anything worth stealing for that much, but assuming moore's law, cost having every 18 months - so, in 10 years, that is 6.66... halfings,
`0.5^6.66=0.00984`, so that `170,000` becomes `170` again!

Even if you render it in time, that century becomes 10 years if you wait ten years first! So it's not really a century at all!

Applying the calculation given in the article to a password like correcthorsebatterystaple* with the settings given in the article, and $0.02 an hour for compute

`.5*Math.pow(2,44)*(.01/100) / (60*60*24/365) = 27 years` which at $170 a year, is only $4590, and in 10 years, $45

\* (incidentially, correcthorsebatterystaple is now a pretty bad password due to the popularity of that xkcd)

Start by reviewing the linked Dropbox article and the issue's AWS compute-cost assumptions. Determine where zxcvbn represents cracking difficulty and define how the result should express cost rather than time; done means the estimate is consistently presented in monetary terms and the existing password example is covered.

Written by the indexing model from the issue text.