Reputation
1,649
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
11 16
Newest
 Good Answer
Impact
~208k people reached

Aug
29
answered Best password strength checker
Aug
29
awarded  Supporter
Aug
29
awarded  Scholar
Aug
29
awarded  Commentator
Aug
29
accepted Pre-hash password before applying bcrypt to avoid restricting password length
Aug
29
comment Pre-hash password before applying bcrypt to avoid restricting password length
... and luckily (or by design?) 64 or 128 bits (8 or 16 characters) of random salt with the 256 bits (32 characters) sha256(password) output does fit within the 55 char bcrypt() limit. Thanks.
Aug
29
comment Pre-hash password before applying bcrypt to avoid restricting password length
Thanks, now fixed
Aug
29
revised Pre-hash password before applying bcrypt to avoid restricting password length
edited body
Aug
25
asked Pre-hash password before applying bcrypt to avoid restricting password length
Aug
25
awarded  Teacher
Aug
25
answered How to best set up public WiFi without giving access to the rest of my network?
Aug
24
comment Best password strength checker
How secure...: plain & initial-cap = instant ("in top 6910"), i->1, s->5 = 1 year, +& = 928 years, +&3 = 71K years. How secure... also uses a wordlist but doesn't use it to reduce its entropy estimate as such, and l33t-speak defeats it. It doesn't use diagraph-frequences so words score the same as alpha-gibberish the same length.
Aug
24
comment Best password strength checker
Rumkin.com: plain = 29.9b ("common password!"), initial-cap = 36.3b ("common password!"), i->1 = 38.7b, s->5 = 38.1b, +& = 43.1b, +&3 = 46.7b. Rumkin uses a wordlist to detect "common passwords", BUT it doesn't reduce the entropy as a result. It does use character digraphs to estimate the entropy (based on English digraph frequencies), which will compensate for that to some extent. However, it doesn't take l33t-speak substitutions into account for either the "common word" or digraph frequency estimates.
Aug
24
comment Best password strength checker
As a simple test, lets try some variations of "christmas" (plain lower case, initial cap, i->1).
Aug
23
revised How reliable is a password strength checker?
corrected and elaborated entropy calculation for password and passphrase
Aug
23
revised How reliable is a password strength checker?
caveat on article reference
Aug
23
suggested approved edit on How reliable is a password strength checker?
Aug
23
suggested approved edit on How reliable is a password strength checker?
Aug
23
revised Best password strength checker
added 198 characters in body
Aug
23
comment Best password strength checker
In particular, the Microsoft checker doesn't "follow the math" of the comic wrt to the (limited) entropy added by the l33t-ifying and punct/digit modifiers. It also doesn't use any math for the impact of length on security -- rather it has minimum lengths of 8 and 14 chars.