dropbox / dropbox/zxcvbn

Diacritics removal before dictionary check

Open
#97 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
CoffeeScript
Stars
16.1k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

I believe it would be useful (especially for many languages other than english),
to also try and remove diagritics/ligature characters from the initial given password before trying to match it with words in the lists, probably adding some modifier score to the final complexity.
As it is right now it's very easy to come up with a very bad password, like this example:
"pässwörd"
entropy: 41.068
crack time (seconds): 115280994.221
crack time (display): 4 years

An example of how to perform this operation can be seen here:
http://stackoverflow.com/questions/990904/javascript-remove-accents-diacritics-in-strings

I believe this shouldn't really slow down computation a lot, and would greatly increase the tool's reliability, with current word lists and especially maybe in the future with word lists in other languages.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at the initial password and dictionary-check path, using the linked Stack Overflow diacritics-removal example as reference. Compare the example “pässwörd” before and after removing diacritics and ligatures, then verify that dictionary matching lowers its estimated complexity and that the added scoring adjustment does not materially slow computation.

Written by the indexing model from the issue text.

Assessment

Tech stack
coffeescript
Domain
security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.