#1176 Strong Passwords Are Considered Weak

[Josua Schmid]

The policy for deciding the weakness of a master password is not good enough. It only checks the absolute length and the use of three alphabets with 62 letters in minimum. Thats an entropy of about 48 bits if challenged with brute force (without dictionary). That can be secure enough.

I criticize that longer words with just one or multiple smaller alphabets are not considered secure. I propose to omit the alphabet check for words longer than 10 letters. That's an entropy of about 48 bits with an alphabet of 26 letters (also without dictionary attacks in mind).

To fund my consideration I'd like to refer to this webcomic: http://xkcd.com/936/

For version 3.33 the code I'm talking about is located on line 463 of PWCharPool.cpp (CPasswordCharPool::CheckPassword).

Update:
What I've written above is valid for computer generated passwords. Human generated passwords must be longer. See here for background: http://en.wikipedia.org/wiki/Password_strength#Human-generated_passwords

[Rony Shapiro]

The question of what's considered a "strong" password does not have a single agreed-upon answer. I'm pretty sure that for every change that I make, a case can be made for why the change is "wrong" in some sense.

If you have a concrete suggestion as to what the criteria for CPasswordCharPool::CheckPassword() should be, I'd be glad to consider it.
The only caveat is that I do not want to burden PasswordSafe with a dictionary check for passwords.

[Josua Schmid]

Here is my suggestion:

bool CPasswordCharPool::CheckPassword(const StringX &pwd, StringX &error)
{
  const size_t MinLength = 8;
  size_t length = pwd.length();
  // check for minimun length
  if (length < MinLength) {
    LoadAString(error, IDSC_PASSWORDTOOSHORT);
    return false;
  }

  const size_t SufficientLength = 12;
  // omit check if password is long enough, because alphabet check is profitless then
  if (length >= SufficientLength) {
    return true;
  }

  // check for at least one  uppercase and lowercase and  digit or other
  bool has_uc = false, has_lc = false, has_digit = false, has_other = false;

  for (size_t i = 0; i < length; i++) {
    charT c = pwd[i];
    if (_istlower(c)) has_lc = true;
    else if (_istupper(c)) has_uc = true;
    else if (_istdigit(c)) has_digit = true;
    else has_other = true;
  }

  if (has_uc && has_lc && (has_digit || has_other)) {
    return true;
  } else {
    LoadAString(error, IDSC_PASSWORDPOOR);
    return false;
  }
}

We should not punish people who use long easy-to-remember passwords like "correcthorsebatterystable" instead of "P4infu1!"

I'm with you in not using a dictionary check for user passwords. Alternatively you could calculate the Shannon Entroy in combination with a minimum password length. That would be fast and meaningful: http://rosettacode.org/wiki/Entropy

[Rony Shapiro]

OK, I've accepted your suggestion, thanks. As to entropy, I might use this to give a "strength" value to passwords (not only master) in the future.

master 3c18e44