personal-security-checklist
zxcvbn
Our great sponsors
personal-security-checklist | zxcvbn | |
---|---|---|
55 | 59 | |
15,249 | 14,595 | |
- | 1.3% | |
9.0 | 0.0 | |
4 days ago | about 1 month ago | |
TypeScript | CoffeeScript | |
GNU General Public License v3.0 or later | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
personal-security-checklist
- The Personal Security Checklist
-
Enhancing Online Privacy: Seeking Additional Tips and Recommendations
Following the GitHub repository: https://github.com/Lissy93/personal-security-checklist for tips
-
My list of Privacy Friendly Apps and Services to ditch Big Tech Companies
Other list for inspiration: - https://github.com/pluja/awesome-privacy - https://github.com/Lissy93/personal-security-checklist - https://github.com/Psyhackological/AAA
-
Ask HN: What do you do for online privacy?
I found this quite useful, and follow some of the ideas.
https://github.com/Lissy93/personal-security-checklist
Credits: to HN homwpage post I saw months ago
- What other privacy suggestion websites should I check out
- I'm searching for a website that compiled a bunch of privacy tools/software. Need help finding it!
-
Awesome-Privacy: List of 500 FOSS alternatives to escape big tech
Just a different take on the same topic. This project branched off of personal-security-checklist, the software section was moved to a separate repo last week in order to be more community driven.
-
Awesome Privacy - A curated list of privacy-respecting & FOSS software. PRs welcome!
Yeah, it's a common topic :) This list originated from personal-security-checklist, but I am hoping that separating the two can make it more user-driven, and hence more impartial 🤞
-
What are the "idiot's guide to privacy/cybersecurity" things everyone should know?
I found this list to be pretty comprehensive
zxcvbn
-
Show HN: A lightweight PHP library for checking password strength
Lightweight is an understatement here.
A client's project (with not necessarily technical customers) has had pretty reasonable success using the Dropbox originated library[1] for this, `zxcvbn`[2], on both frontend via js (for "instant" feedback) and on the backend via php (to enforce the requirements when writing password hashes to the database)
1: https://dropbox.tech/security/zxcvbn-realistic-password-stre...
-
How hard could it be? Sorting words alphabetically in Rust
In contrast, let's consider the password "zxcvbn214". How might we assign an entropy to this password? Is it 369? Or 266 * 103? Anyone familiar with a QWERTY keyboard or Dropbox's password strength estimator knows that "zxcvbn" is hardly a random sequence of letters. This same principle applies to "l33t" speak, e.g. replacing all "e"s with 3s and "a"s with 4s. These strategies may "trick" simple entropy calculations into estimating a high entropy, but it won't trick sophisticated attackers. This leads to strength over-estimation, which is, I argue, the worst thing we can do in this context.
-
TIL There's Another YAML
> except for ZXCVBN
You mean the Low-Budget Password Strength Estimator?
https://github.com/dropbox/zxcvbn
Yeah, that name is totally legit.
-
Which tool can crack this password so fast?
For any part of the password that the zxcvbn cannot match to a known pattern, it uses a brute-force cardinality of 10, i.e., it estimates that the number of guesses required to crack a password or password segment of length N is equal to 10N (equivalent to the number of guesses required to exhaust all possibilities if your password consisted only of numbers).
-
Bitwarden Design Flaw
We took a similar approach to passphrase stretching in EnvKey[1] v1 (EnvKey is a secrets manager, not a passwords manager, but uses end-to-end encryption in a similar way). We used PBKDF2 with iterations set a bit higher than the currently recommended levels, as well as Dropbox's zxcvbn lib to try to identify and block weak passphrases.
Ultimately, I think it's just not good enough. Even if you're updating iteration counts automatically (which is clearly not a safe assumption, and to be fair not something we did in EnvKey v1 either), and even with safeguards against weak passphrases, using human-generated passphrases as a single line of defense is just fundamentally weak.
That's why in EnvKey v2, we switched to primarily using high entropy device-based keys--a lot like SSH private keys, except that on Mac and Windows the keys get stored in the OS keychain rather than in the file system. Also like SSH, a passphrases can optionally be added on top.
The downside (or upside, depending how you look at it) is that new devices must be specifically granted access. You can't just log in and decrypt on a new device with only your passphrase. But the security is much stronger, and you also avoid all this song and dance around key stretching iterations.
-
What We Do in the /etc./Shadow – Cryptography with Passwords
> There's another end of all this that I also never see addressed in writeups like this one: lots of users are still really bad at passwords.
Author here.
I was originally planning to write a blog post about my experience reporting cryptography-related bugs to password managers in 2022. (I had findings for LastPass, 1Password, and Keeper.)
My experience with LastPass was abysmal. I wrote a thread about it here: https://furry.engineer/@soatok/109560736140669727
However, I found in my early draft that I spent a lot of time explaining these algorithms, so I decided to spin it off into a separate article. Thus, this post was conceived!
> Readers capable of implementing something like OPAQUE will already have a pretty good handle on most of what's written here. All other developers will just grab whatever "the" off-the-shelf solution is for their language and tech stack, and any recommendations for those are conspicuously absent here. What are the best resources for the most popular tech stacks currently? PHP introduced the password_hash() function (and related functions) in its standard library a while back. It defaults to bcrypt, and most php devs should probably just use those functions, unless they're sure they know better.
I tried to make the post a good balance of fun and informative, but the audience was "people who want to know more about cryptography with passwords" not specifically developers.
As you indicated, if you're developing something, the password_hash() / password_verify() API your language provides is likely 1000x safer than rolling your own anything. If there is to be improvements in the cryptography for a given programming language, it should be an update to whatever the de facto standard library is for that language.
PHP has the password extension built-in. Python has passlib. Node has the crypto module. Etc.
> For a while, some misguided sites tried to prevent people from pasting passwords into their login forms. I have never seen the inverse: a site that prevents users from typing a password. Is there a reason that wouldn't work?
I'm not confident in this, since it's 4:46 AM for me and I should probably be sleeping instead of reading HN comments, but isn't this exactly how Passkey is supposed to work?
Anyway, thanks for your insightful feedback. I already planned a teardown into the reverse-engineered internals of popular password managers and my experiences with them. Because of your comment, I might also make a future blog post targeting developers.
In the meantime, here's some cool stuff:
https://github.com/dropbox/zxcvbn - A reasonable approach to password strength estimation (although I think their calculation needs updating in 2023)
https://github.com/DivineOmega/password_exposed - Checks if a given password has been exposed in a previous breach (uses the HIBP hash database)
-
Password Strength Recommendations for 2023?
Did you hear about that one? https://github.com/dropbox/zxcvbn
-
Password Requirements: Myths and Madness
The author links to a recommended library in the blog post
-
I made my first program, a password generator.
See also zxcvbn and original for the rationale.
- This collecting personal data?
What are some alternatives?
awesome-cybersecurity-blueteam - :computer:🛡️ A curated collection of awesome resources, tools, and other shiny things for cybersecurity blue teams.
SecLists - SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
monkeytype - The most customizable typing website with a minimalistic design and a ton of features. Test yourself in various modes, track your progress and improve your speed.
keepassxc - KeePassXC is a cross-platform community-driven port of the Windows application “Keepass Password Safe”.
Filterlist-for-AdGuard-or-PiHole - A very aggressive filter-list that consolidates over 370 lists for use in AdGuard Home, Pi-Hole or similar.
privacyguides.org - Protect your data against global mass surveillance programs.
awesome-bugbounty-tools - A curated list of various bug bounty tools
dumb-password-rules - A compilation of sites with dumb password rules.
Next.js - The React Framework
Material UI - Ready-to-use foundational React components, free forever. It includes Material UI, which implements Google's Material Design.
React - The library for web and native user interfaces.
serve - Static file serving and directory listing