Comments for Yet Another Password Meter

Comment on Got a new fan by Rene

Rene — Tue, 21 Jun 2011 07:32:06 +0000

@Antenore: You are right. I have a few things in the pipe to improve the YAPW, so I will add this. Thanks.

Comment on Got a new fan by Antenore Gatta

Antenore Gatta — Tue, 21 Jun 2011 07:29:26 +0000

Hi Rene,

It’s really well made your Password Meter, but it’s true that is not easy to notice the hover-over functionality.

You could add a red question mark at the end of the description…

Comment on A new version arrived – v1.1.0 is here by Rene

Rene — Fri, 18 Mar 2011 07:19:45 +0000

@Amiel: Thanks for the input. The idea of the significance is, that there are still legacy systems that only care about the first 8 characters. So if the beginning of the password is too simple, it does not help to make it stronger later because the target system does not care.

I will take a lock at your code soon and see if I can incorporate it.

Thank again.

Comment on A new version arrived – v1.1.0 is here by Amiel Martin

Amiel Martin — Thu, 17 Mar 2011 23:10:09 +0000

Rene, thank you for yetanotherpasswordmeter. This is very helpful.

I’m not sure if I understand the “significance” feature. I guess I feel that aA-.85fG!11111111 and 11111111aA-.85fG! are equally as strong.

Anyway, I appreciate that you’ve included the option to turn the feature off with the “splitPassword” argument. However, the way that it is written, it is impossible to turn off.

The following change will fix the issue:

- if (!splitPassword)
- {
- splitPassword = true;
- }
-
+ if (typeof splitPassword === “undefined”)
+ {
+ splitPassword = true;
+ }

Comment on Got a new fan by Eric

Eric — Fri, 14 Jan 2011 20:15:02 +0000

Posted a link on my blog : http://debian-bits-and-snips.blogspot.com/2011/01/test-your-password.html

Comment on About by Ted Tschopp

Ted Tschopp — Wed, 29 Sep 2010 17:44:19 +0000

I took Jeff’s password Meter and updated it for a work IT event. I wanted to pass the code along. It includes a dictionary lookup and a common password list lookup.

http://www.tschopp.net/Password%20Challange.zip

Just trying to pass along the changes (some of the javascript could be improved, but I only had 16 hours to do the work)

Comment on A new version arrived – v1.1.0 is here by Rene

Rene — Thu, 01 Jul 2010 20:32:49 +0000

@mischachiaro: I fully agree that you need longer password for strong encryption. I designed my web site to give normal user a help for protecting himself a little better. You are an expert already.

Comment on A new version arrived – v1.1.0 is here by mischachiaro

mischachiaro — Thu, 01 Jul 2010 20:20:55 +0000

I don’t know how to code. I encrypt all my drives with TrueCrypt. That’s why I was trying long passwords. Those people I know, who use full computer encryption (with TrueCrypt or otherwise, some Linux distros have it as a native option), use 20+ characters passwords as well. It’s standard behaviour for heavy encryption, since the password in that case is the weakest link.

Web services have exploitable vulnerabilities beyond the user’s reach. People normally aren’t afraid of having the data from their computers compromised, so they don’t use encryption. That’s why passwords of more than 8 to 12 characters offer little to no benefit in those cases, the system itself is less secure than the security a long password could offer.

Comment on A new version arrived – v1.1.0 is here by Rene

Rene — Wed, 30 Jun 2010 20:57:31 +0000

@mischachiaro: Well, I tried to make it as real as possible. Long passwords are unusal and a normal human will neither use or manage them.

Why are these long passwords important and why does it make it difference how much redundancy it has? The first part is already good enough to be hard to break.

If you are fit in JavaScript, you can take the code (it’s free) and improve it. I would really value your contribution. An option to determine the desired optimal length for instance would be a good feature.

Thanks.

Comment on A new version arrived – v1.1.0 is here by mischachiaro

mischachiaro — Wed, 30 Jun 2010 20:49:57 +0000

Another peculiarity. The password ” QmJ/6LTxt:Yrg’-1111111111 ” has the same scores as ” QmJ/6LTxt:Yrg’-1WK.IJuoDb “. The only thing that changes in the stats is redundancy, which doesn’t affect the scores.

I think your password meter is optimized for 8 character strings. I’d like to see it manage long passwords better. For 8 character passwords it’s fine.