Zxcvbn is a password strength measurement tool from Dropbox that does a good job of measuring the strength of a password by detecting the entropy of the likely patterns within the password.

The tech is described at https://tech.dropbox.com/2012/04/zxcvbn-realistic-password-strength-esti... but it's best to also see how it works from this demo https://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.html

I developed the approach to in PHP at https://github.com/bjeavons/zxcvbn-php and want to provide a constraint for Password Policy.

This will require the Zxcvbn-Php library to work so I've implemented a possible solution for Drupal integration using xautoload at https://drupal.org/sandbox/coltrane/2231935

CommentFileSizeAuthor
#1 2231941-password-policy-zxcvbn.patch1.83 KBcoltrane

Comments

coltrane’s picture

coltrane
he/him
commented
Status: Active » Needs review
StatusFileSize
new 2231941-password-policy-zxcvbn.patch1.83 KB

Here's the start of a constraint. I think this is mostly all that can be integrated for Password Policy. ZxcvbnPhp provides the matches that were detected in the password but it's not easy to expose that thru password policy at the moment.

erikwebb’s picture

erikwebb commented

Since constraints can be added as a CTools plugin for any module, might it be worth implementing this as a submodule? Adding an external dependency to the core module doesn't sit right with me.

coltrane’s picture

coltrane
he/him
commented
Status: Needs review » Closed (won't fix)

@erikwebb that makes sense. I've pushed this as https://drupal.org/sandbox/coltrane/2236437

erikwebb’s picture

erikwebb commented

If we think it's a big improvement, I think we could add it as a submodule here, but at least we have the flexibility.

mgifford’s picture

mgifford
he/him
Primary language English
commented
Related issues: +#1815660: Implement simple integer-based constraint for overall "strength", +#1497290: Check for common words in password strength indicators

Note related issue in Core. I do think that this would be a good sub-module.

Although https://github.com/dropbox/zxcvbn is a bit old, I do think that the Dropbox folks are planning to upgrade it fairly soon.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented

@mgifford what do you mean by "a bit old" ? It has commits as of January 2014 which feels pretty recent to me. This also doesn't seem like the kind of code that needs constant updating.

mgifford’s picture

mgifford
he/him
Primary language English
commented

Heck from June 1st now.
https://github.com/dropbox/zxcvbn/commit/0a8b5b65a1864437eaac5b8828571c8...

I got this from the Dropbox team in April:
"Thanks for writing in! We are definitely still working on zxcvbn, but development lately has slowed down somewhat. We will continue to work on the zxcvbn library in the future and haven't forgotten about it! Unfortunately, I don't have a good time frame for when activity will resume on it but I checked with the engineers and they said they would (ideally) like to get back around to updating the library in the coming weeks."

I do think that there are new "popular" bad passwords every year, but not sure where these lists are being generated from. The list of bad passwords is 2 years old:
https://github.com/dropbox/zxcvbn/tree/master/data

The code itself may not need to change, but it's useful to see that a project is keeping up with the issue queue. It's not too bad, but there are certainly reason to think that a completely polished piece of code:
https://github.com/dropbox/zxcvbn/issues

Also worth noting, there's also a Drupal module for this:
https://www.drupal.org/project/zxcvbn