scip/valpass
1
0
Fork 0
mirror of https://codeberg.org/scip/valpass.git synced 2025-12-16 20:21:00 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix typos

Browse Source
This commit is contained in:
T.v.Dein
2024-10-11 23:52:16 +02:00
committed by GitHub
parent c84cae7e09
commit f223dad506
1 changed files with 12 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
README.md
View File

@@ -18,7 +18,7 @@ with go as a reusable module.
- uses 3 different metrics to measure password quality - uses 3 different metrics to measure password quality
- you can configure which metric to use - you can configure which metric to use
- you can also configure the quality thresholds - you can also configure the quality thresholds
- there's support for dictionary lookup, but you need to provide the dictionary - there's support for dictionary lookup, but you need to provide the dictionary yourself
- different metrics for ASCII and UTF-8 character space - different metrics for ASCII and UTF-8 character space
- it's reasonably fast - it's reasonably fast
- the code is small enough to just copy it into your code - the code is small enough to just copy it into your code
@@ -32,9 +32,9 @@ to guess. Don't be fooled by those "use special characters"
evangelists: diceware passwords as outlined in the evangelists: diceware passwords as outlined in the
well known xkcd comic are by far the best ones. well known xkcd comic are by far the best ones.
However, if it's your job zo implement a register However, if it's your job to implement a registration
user interface, then sooner or later you'll need user interface, then sooner or later you'll need
to validate the password the user just entered. to validate passwords.
This module can be used for this job. This module can be used for this job.
@@ -43,11 +43,11 @@ By default it checks 3 metrics:
### Entropy ### Entropy
Entropy in this case measures the cryptographic Entropy in this case measures the cryptographic
strength of the password. I non-technical words: strength of the password. In non-technical words:
it checks how scrambled the password looks or how it checks how scrambled the password looks or how
many different bits it uses. many different bits it uses.
By default we only look for printable US-ASCII characters. By default we only look for printable US-ASCII characters. But you can switch to UTF-8 as well.
### Character diffusion ### Character diffusion
@@ -55,7 +55,7 @@ Of course just measuring entropy is insufficient. For
instance a password `12345678` consists of 8 different instance a password `12345678` consists of 8 different
characters and might pass the entropy check. However, as characters and might pass the entropy check. However, as
can be easily seen, the characters are sorted and can be easily seen, the characters are sorted and
therefore this password would be s terrible one. therefore this password would be a terrible one.
Thus, character diffusion measures how characters are Thus, character diffusion measures how characters are
distributed. distributed.
@@ -64,7 +64,7 @@ Keep in mind that these two metrics would flag
the `Tr0ub4dor&3` password of the comic as pretty good, the `Tr0ub4dor&3` password of the comic as pretty good,
while in reality it's not! You might remedy while in reality it's not! You might remedy
this problem with a longer mandatory password this problem with a longer mandatory password
length. But zhe harsh reality is, that people still length. But the harsh reality is that people still
use such passwords. use such passwords.
### Compression ### Compression
@@ -74,10 +74,11 @@ the password can be compressed. For instance, let's
look at this run length encoding example: look at this run length encoding example:
The string `aaabggthhhh` can be rle encoded to The string `aaabggthhhh` can be rle encoded to
`2ab2gt4h`. The ideal password cannot be compressed `2ab2gt4h`. The result is shorter than the original, it is compressed.
The ideal password cannot be compressed
or not much. or not much.
Of course ee do not use RLE. We measure compression Of course we do not use RLE. We measure compression
using the [Flate algorithm]( using the [Flate algorithm](
https://en.m.wikipedia.org/wiki/Deflate). https://en.m.wikipedia.org/wiki/Deflate).
@@ -85,10 +86,10 @@ https://en.m.wikipedia.org/wiki/Deflate).
You can supply a dictionary of words of your You can supply a dictionary of words of your
liking and check if the password under test liking and check if the password under test
matches one if the words. Submatches can also matches one of the words. Submatches can also
be done. be done.
### Custom ### Custom measurements
You can also enable or disable certain metrics and You can also enable or disable certain metrics and
you can tune the quality thresholds as needed. you can tune the quality thresholds as needed.