lowe/zxcvbn — pull request #30 by threadmetal (2013-08-09 05:22:45+00:00)
Title: Guess URL for bootstrapping

This pull request defaults the location of `zxcvbn.js` to be the same as `zxcvbn-async.js` -- if you just drop both files, unedited, into your assets directory, you won't accidentally be fetching the dropbox copy -- and it still "Just Works". On the other hand, if you "opt-in" to using CDN hosted authentication-related scripts (which, truth be told, is fine for a majority of sites) -- that "Just Works" too.

Before this patch, `zxcvbn-async.js` works out-of-box by setting up a hardcoded script tag pointing to a DropBox copy of `zxcvbn.js` (async.coffee, line 2)

This is great for the "Just Works" effect -- but that dropbox account becomes a single point of failure or compromise, for every site which forgets to or chooses not to reconfigure `zxcvbn-async.js`.

Your script is intended to improve security, and receives the user's credentials, and probably other privacy-sensitive information as well. Ideally, that sort of code should be served only via HTTPS from the authenticating site. IMHO, the default configuration shouldn't subvert that, though of course it should still be configurable to use CDN.