fnando/password_strength — Issue #2: dictionary attacks
Author: barmstrong
Created: 2012-01-26 22:59:29+00:00
State: open

Hey, thanks for posting this! It's really been helpful.

One thing I noticed is that "password1" returns a :good score.

Which was supposedly the most common password on MySpace:
http://blog.jimmyr.com/Password_analysis_of_databases_that_were_hacked_28_2009.php

I was wondering if you had any ideas on detecting common passwords. I can take a crack at writing the code for it but was just curious your thoughts.

A dictionary file could be included, I found some here: http://lastbit.com/dict.asp

But we'd still want to allow passwords like "correct horse stapler battery" to return :strong just due to their length. Thoughts?