Czech your passwords.
-
@jupiter Which website is this? That's weird! zxcvbn measures both passwords as weak and old-style (aka bad) password strength meters overestimate mixing character classes (so repeating a single character wouldn't work).
@qgustavor@urusai.social @jupiter@mastodon.gamedev.place What if the carons are combining (U+0072 then U+030c)? Are these a different character classes?
-
Czech your passwords.
@jupiter@mastodon.gamedev.place This is at least 9 bits of entropy, if the app doesn't normalize its Unicode strings.
Example:řřřřřřřřřandřřřřřřřřřmight seem to be different for some SW. (Idk whether my fedi client normalized the text – I'll edit if it did.)
Compare plain pre-combinedřas U+XXXX and ASCIIrwith a combining caron coded as U+0072 then U+030c. These should render the same. -
@jupiter@mastodon.gamedev.place This is at least 9 bits of entropy, if the app doesn't normalize its Unicode strings.
Example:řřřřřřřřřandřřřřřřřřřmight seem to be different for some SW. (Idk whether my fedi client normalized the text – I'll edit if it did.)
Compare plain pre-combinedřas U+XXXX and ASCIIrwith a combining caron coded as U+0072 then U+030c. These should render the same.@jupiter@mastodon.gamedev.place
Copied and pasted from the post, you can tell they are different in the hexdump.
Fun fact: When pasted into a Vim, searching forřřřřřřřřřhighlights only one of the ř-words. But when I round-tripped it through XTerm (with UTF-8 enabled), the strings were normalized!řřřřřřřřř and řřřřřřřřř 00000000: 72cc 8cc5 99c5 99c5 99c5 9972 cc8c 72cc r..........r..r. 00000010: 8c72 cc8c 72cc 8c20 616e 6420 c599 c599 .r..r.. and .... 00000020: c599 c599 c599 c599 c599 c599 c599 0a ............... -
@qgustavor@urusai.social @jupiter@mastodon.gamedev.place What if the carons are combining (U+0072 then U+030c)? Are these a different character classes?
@diffie @jupiter
Depends on the implementation!One: implementations can use Unicode normalisation so it always handles them combined or always separated.
Two: zxcvbn detects repetition (and penalises it) even strings of two or more repeated substrings!
Three: for character classes-based algorithms, those are weird! IMHO in most cases those are based on "let me guess what a good password is because management asked for a password strength meter" and thus you have lots of implementations based on regex, but also ranges of ASCII ranges and all sorts of mess code. I wonder if AI still generates this messy code or if they just recommend a properly tested library like zxcvbn. I guess the first.
-
@jupiter@mastodon.gamedev.place
Copied and pasted from the post, you can tell they are different in the hexdump.
Fun fact: When pasted into a Vim, searching forřřřřřřřřřhighlights only one of the ř-words. But when I round-tripped it through XTerm (with UTF-8 enabled), the strings were normalized!řřřřřřřřř and řřřřřřřřř 00000000: 72cc 8cc5 99c5 99c5 99c5 9972 cc8c 72cc r..........r..r. 00000010: 8c72 cc8c 72cc 8c20 616e 6420 c599 c599 .r..r.. and .... 00000020: c599 c599 c599 c599 c599 c599 c599 0a ...............@diffie @jupiter@mastodon.gamedev.place which makes me wonder, if you allow (for the argument) non-ascii chars in passwords, should you normalize input, and where/when?
take the case of someone using a website. -
@diffie @jupiter@mastodon.gamedev.place which makes me wonder, if you allow (for the argument) non-ascii chars in passwords, should you normalize input, and where/when?
take the case of someone using a website.@Override @jupiter@mastodon.gamedev.place … or over-normalize the text.
I noticed that Discord converts my U+00a0 NBSPs to U+0020 plain spaces. -
@diffie @jupiter
Depends on the implementation!One: implementations can use Unicode normalisation so it always handles them combined or always separated.
Two: zxcvbn detects repetition (and penalises it) even strings of two or more repeated substrings!
Three: for character classes-based algorithms, those are weird! IMHO in most cases those are based on "let me guess what a good password is because management asked for a password strength meter" and thus you have lots of implementations based on regex, but also ranges of ASCII ranges and all sorts of mess code. I wonder if AI still generates this messy code or if they just recommend a properly tested library like zxcvbn. I guess the first.
@qgustavor@urusai.social @jupiter@mastodon.gamedev.place I've seen even a password meter which was totally fine with 10s of
as and it said it's a strong password, so… yes.
-
-
@chemlon
Třista třicet tři stříbrných stříkaček stříkalo přes třista třicet tři stříbrných střech. -
Czech your passwords.
@jupiter Hope to never have to login at another keyboard in the world!
or keep the Unicode at hand 
-
Czech your passwords.
En France c'est ééééééééé
-
S simonjust@mstdn.dk shared this topic
