<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>Do think we can fit this in? It looks pretty great.</div><br><div><div>On Jan 9, 2014, at 3:00 PM, Chris Karlof <<a href="mailto:ckarlof@mozilla.com">ckarlof@mozilla.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">This one is a little better than average, though, :)<br><br><a href="https://tech.dropbox.com/2012/04/zxcvbn-realistic-password-strength-estimation/">https://tech.dropbox.com/2012/04/zxcvbn-realistic-password-strength-estimation/</a><br><br>-chris<br><br><br>On Jan 8, 2014, at 3:51 PM, Chris Karlof <ckarlof@mozilla.com> wrote:<br><br><blockquote type="cite">Hi Madhava,<br><br>I'm not keen on password strength estimators. Two reasons: <br><br>1) It's not clear how they should work. There's a lot of debate of what qualifies as a "strong password". and many strength estimators often do silly things like say "password0" is weak but "password9" is strong. <br>2) They add UX noise for unknown benefit. Plus a believer that if a user really wants a weak password for whatever reason [1], we shouldn't shame them with a big red indicator or frowny face. <br><br>There are some things I think we should do:<br>1) Require a minimum length (8 char?)<br>2) Provide guidance for users who would like to know how to choose a stronger password<br>3) Throttle bad password guesses<br><br>Another interesting idea is to disallow users from using passwords on a "naughty list", e.g., a list of the X hundred or thousand most common passwords. This combined with throttling can be quite effective.<br><br>-chris<br><br>[1] hey, how often do you sign up for a service you don't care about much or just wanna try out and give it some garbage password?<br><br>_______________________________________________<br>Dev-fxacct mailing list<br>Dev-fxacct@mozilla.org<br>https://mail.mozilla.org/listinfo/dev-fxacct<br></blockquote><br>_______________________________________________<br>Dev-fxacct mailing list<br>Dev-fxacct@mozilla.org<br>https://mail.mozilla.org/listinfo/dev-fxacct<br></blockquote></div><br><div apple-content-edited="true">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>Ryan Feeley</div><div>Product Designer, Identity</div><div>Mozilla UX</div><div>IRC: rfeeley</div></div>
</div>
<br></body></html>