{"action":"created","issue":{"url":"https://api.github.com/repos/dropbox/zxcvbn/issues/209","repository_url":"https://api.github.com/repos/dropbox/zxcvbn","labels_url":"https://api.github.com/repos/dropbox/zxcvbn/issues/209/labels{/name}","comments_url":"https://api.github.com/repos/dropbox/zxcvbn/issues/209/comments","events_url":"https://api.github.com/repos/dropbox/zxcvbn/issues/209/events","html_url":"https://github.com/dropbox/zxcvbn/issues/209","id":242229164,"number":209,"title":"Bruteforce and suboptimal scoring chains","user":{"login":"llamadonica","id":38162,"avatar_url":"https://avatars3.githubusercontent.com/u/38162?v=4","gravatar_id":"","url":"https://api.github.com/users/llamadonica","html_url":"https://github.com/llamadonica","followers_url":"https://api.github.com/users/llamadonica/followers","following_url":"https://api.github.com/users/llamadonica/following{/other_user}","gists_url":"https://api.github.com/users/llamadonica/gists{/gist_id}","starred_url":"https://api.github.com/users/llamadonica/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/llamadonica/subscriptions","organizations_url":"https://api.github.com/users/llamadonica/orgs","repos_url":"https://api.github.com/users/llamadonica/repos","events_url":"https://api.github.com/users/llamadonica/events{/privacy}","received_events_url":"https://api.github.com/users/llamadonica/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-07-12T01:20:21Z","updated_at":"2017-08-29T14:26:16Z","closed_at":null,"body":"In my example `lucky_buster_duke`  is chunked into `lucky_`, `buster`, `_`, `duke` with an overall number of guesses of approximately 10^13, mostly due to `lucky_` being scored as a bruteforce segment with.\r\n\r\nUsing your own scoring methods, breaking it up into `lucky`, `_`, `buster`, `_duke` would have a much lower guesses score of around 10^12, but this pattern is not evaluated for some reason. It's the same number of chunks: I know the scoring methods give factorial growth to the guesses score, but that would not matter in this case.\r\n\r\nI think there might be an bug in the bruteforce segment generator or the scoring segment back-tracker."},"comment":{"url":"https://api.github.com/repos/dropbox/zxcvbn/issues/comments/325681108","html_url":"https://github.com/dropbox/zxcvbn/issues/209#issuecomment-325681108","issue_url":"https://api.github.com/repos/dropbox/zxcvbn/issues/209","id":325681108,"user":{"login":"Tostino","id":8227578,"avatar_url":"https://avatars2.githubusercontent.com/u/8227578?v=4","gravatar_id":"","url":"https://api.github.com/users/Tostino","html_url":"https://github.com/Tostino","followers_url":"https://api.github.com/users/Tostino/followers","following_url":"https://api.github.com/users/Tostino/following{/other_user}","gists_url":"https://api.github.com/users/Tostino/gists{/gist_id}","starred_url":"https://api.github.com/users/Tostino/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Tostino/subscriptions","organizations_url":"https://api.github.com/users/Tostino/orgs","repos_url":"https://api.github.com/users/Tostino/repos","events_url":"https://api.github.com/users/Tostino/events{/privacy}","received_events_url":"https://api.github.com/users/Tostino/received_events","type":"User","site_admin":false},"created_at":"2017-08-29T14:26:16Z","updated_at":"2017-08-29T14:26:16Z","body":"That was something I noticed was off with the matching algorithm when I re-implemented zxcvbn in Java.  I ended up doing a bunch of work and coming up with a couple new algorithms to find matches and what to consider brute force or not.  One of those algorithms is slow and correct, but with a large enough problem space will continue matching until the heat death of the universe, the other is faster but much less correct.  I have a heuristic to know that if too much time has elapsed, I should stop using the slow / correct one and switch to the fast one.\r\n\r\nThe algorithms I came up with can be found here: https://github.com/GoSimpleLLC/nbvcxz/blob/master/src/main/java/me/gosimple/nbvcxz/Nbvcxz.java\r\n\r\nHere is the output using console mode from my port:\r\n\r\n``` \r\nPS E:\\Downloads> java -jar .\\nbvcxz-1.4.0.jar\r\nCommands: estimate password (e); generate password (g); quit (q)\r\nPlease enter your command:\r\ne\r\nPlease enter the password to estimate:\r\nlucky_buster_duke\r\n----------------------------------------------------------\r\nTime to calculate: 10 ms\r\nPassword: lucky_buster_duke\r\nEntropy: 30.872189174548\r\nYour password does not meet the minimum strength requirement.\r\nWarning: This is a top-100 common password.\r\nSuggestion: All-uppercase is almost as easy to guess as all-lowercase.\r\nSuggestion: Capitalization doesn't help very much.\r\nSuggestion: Predictable substitutions like '@' instead of 'a' don't help very much.\r\nSuggestion: Reversed words aren't much harder to guess.\r\nSuggestion: Add another word or two. Uncommon words are better.\r\nTime to crack: ONLINE_THROTTLED: 31 years\r\nTime to crack: ONLINE_UNTHROTTLED: 7 months\r\nTime to crack: OFFLINE_BCRYPT_14: 3 months\r\nTime to crack: OFFLINE_BCRYPT_12: 27 days\r\nTime to crack: OFFLINE_BCRYPT_10: 6 days\r\nTime to crack: OFFLINE_BCRYPT_5: 5 hours\r\nTime to crack: OFFLINE_SHA512: instant\r\nTime to crack: OFFLINE_SHA1: instant\r\nTime to crack: OFFLINE_MD5: instant\r\n-----------------------------------\r\nMatch Type: DictionaryMatch\r\nEntropy: 8.566054038171092\r\nToken: lucky\r\nStart Index: 0\r\nEnd Index: 4\r\nLength: 5\r\nDictionary: passwords\r\nDictionary Value: lucky\r\nRank: 379\r\nLength: 5\r\nLeet Substitutions: false\r\nReversed: false\r\nDistance: 0\r\n-----------------------------------\r\nMatch Type: SeparatorMatch\r\nEntropy: 3.3219280948873626\r\nToken: _\r\nStart Index: 5\r\nEnd Index: 5\r\nLength: 1\r\n-----------------------------------\r\nMatch Type: DictionaryMatch\r\nEntropy: 5.426264754702098\r\nToken: buster\r\nStart Index: 6\r\nEnd Index: 11\r\nLength: 6\r\nDictionary: passwords\r\nDictionary Value: buster\r\nRank: 43\r\nLength: 6\r\nLeet Substitutions: false\r\nReversed: false\r\nDistance: 0\r\n-----------------------------------\r\nMatch Type: SeparatorMatch\r\nEntropy: 3.3219280948873626\r\nToken: _\r\nStart Index: 12\r\nEnd Index: 12\r\nLength: 1\r\n-----------------------------------\r\nMatch Type: DictionaryMatch\r\nEntropy: 10.236014191900086\r\nToken: duke\r\nStart Index: 13\r\nEnd Index: 16\r\nLength: 4\r\nDictionary: passwords\r\nDictionary Value: duke\r\nRank: 1206\r\nLength: 4\r\nLeet Substitutions: false\r\nReversed: false\r\nDistance: 0\r\n```"}}
{"actor":{"display_login":"Tostino"}}