OWASP Passfault - Revision history

Cam Morris: /* Demo Site */

2017-04-12T16:03:15Z

‎Demo Site

Cam Morris: /* FAQs */

2017-04-12T16:02:39Z

‎FAQs

Cam Morris: /* FAQs */ "java haters", client-side versus server side processing

2017-04-12T16:02:04Z

‎FAQs: "java haters", client-side versus server side processing

Cam Morris: /* FAQs */

2017-04-12T15:13:04Z

‎FAQs

Cam Morris: /* FAQs */

2017-04-12T15:07:21Z

‎FAQs

Cam Morris: /* FAQs */

2017-04-11T23:32:17Z

‎FAQs

Cam Morris: Added Bernardo's Research on Passfault

2017-04-11T21:32:10Z

Added Bernardo's Research on Passfault

Cam Morris: /* Main */

2016-10-27T14:02:49Z

‎Main

Cam Morris: /* Main */

2016-10-27T14:01:53Z

‎Main

Cam Morris: Added Cornell reference

2016-05-26T21:43:55Z

Added Cornell reference

@@ Line 126: / Line 126: @@
 ; Why java - I hate java.  If it were only in language ''x'' I'd use it.
-; Passfault is packaged up in docker as a microservice.  You'd probably want to run passfault as a microservice anyway, so forget that it's java and just run with it.  That said, we welcome any ports to typescript or any other language.
+: Passfault is packaged up in docker as a microservice.  You'd probably want to run passfault as a microservice anyway, so forget that it's java and just run with it.  That said, we welcome any ports to typescript or any other language.
 Discuss with us more on twitter [[https://twitter.com/c4mm0r]] or join the email list: [[https://lists.owasp.org/mailman/listinfo/passfault]]

@@ Line 114: / Line 114: @@
 ; Why do you need to pass the password over the wire?! Isn't that insecure? Others do it in javascript-client why don't you?
-; Passfault's mission is to replace password policies, not just be a cute strength meter.  It was intended to be used by the sites that already take and use your passwords.  With that use-case, adding Passfault doesn't lessen security in any way.  Plus it has the added benefit that we can store LOTS of password lists and do some in-depth analysis that can't be done client-side.
+: Passfault's mission is to replace password policies, not just be a cute strength meter.  It was intended to be used by the sites that already take and use your passwords.  With that use-case, adding Passfault doesn't lessen security in any way.  Plus it has the added benefit that we can store LOTS of password lists and do some in-depth analysis that can't be done client-side.
 ; Does 2FA (two-factor authentication) make Passfault obsolete?

@@ Line 112: / Line 112: @@
 * HTTPS is required on this URL (using the appspot domain)
 To be extra cautious, download the code and execute it locally. (See the readme) https://github.com/c-a-m/passfault/blob/master/README.txt
 ; Does 2FA (two-factor authentication) make Passfault obsolete?
@@ Line 121: / Line 124: @@
 ; How does Passfault compare to zxcvbn?
 : Passfault is very similar to zxcvbn in it's approach to password analysis.  In fact it is the only comparable tool that we know of, and the only alternative we endorse.  zxcvbn presents the strength in units of "entropy", this measurement could be derived from passfault's "pattern size", however we feel that the "time-to-crack" help convey to the end user it's real risk (the downside to this is that really large numbers don't mean much to users, 10 years, or 10 million years, still feels like a long way away.  Entropy is logarithmic so it shows this better.  However entropy units are not intuitive to users.).  We also search for a few more patterns that we think are valuable.
 Discuss with us more on twitter [[https://twitter.com/c4mm0r]] or join the email list: [[https://lists.owasp.org/mailman/listinfo/passfault]]

@@ Line 120: / Line 120: @@
 ; How does Passfault compare to zxcvbn?
-: Passfault is very similar to zxcvbn in it's approach to password analysis, in fact it is the only comparable tool that we know of, and the only alternative we endorse.  zxcvbn presents the strength in units of "entropy", this measurement could be derived from passfault's "pattern size", however we feel that the "time-to-crack" help convey to the end user it's real risk (the downside to this is that really large numbers don't mean much to users, 10 years, or 10 million years, still feels like a long way away.  Entropy is logarithmic so it shows this better.  However entropy units are not intuitive to users.).  We also search for a few more patterns that we think are valuable.
+: Passfault is very similar to zxcvbn in it's approach to password analysis.  In fact it is the only comparable tool that we know of, and the only alternative we endorse.  zxcvbn presents the strength in units of "entropy", this measurement could be derived from passfault's "pattern size", however we feel that the "time-to-crack" help convey to the end user it's real risk (the downside to this is that really large numbers don't mean much to users, 10 years, or 10 million years, still feels like a long way away.  Entropy is logarithmic so it shows this better.  However entropy units are not intuitive to users.).  We also search for a few more patterns that we think are valuable.
 Discuss with us more on twitter [[https://twitter.com/c4mm0r]] or join the email list: [[https://lists.owasp.org/mailman/listinfo/passfault]]

@@ Line 117: / Line 117: @@
 ; Some argue that password policies make passwords less secure, does that apply to Passfault?
-: Researchers have found that of all techniques used by password policies, only the required length had an effect on the overall strength, and even that claim is dubious.  Passfault works different and we claim we can do better, a lot better, than any traditional password policy.
+: Researchers have found that, of all techniques used by password policies, only the required length had an effect on the overall strength, and even that claim is dubious.  Passfault works different and we claim we can do better, a lot better, than any traditional password policy.
 ; How does Passfault compare to zxcvbn?

@@ Line 55: / Line 55: @@
 == Research ==
 ''General Framework for Evaluating Password Complexity and Strength'' [[http://arxiv.org/abs/1512.05814 Cornell University Library]]
 "...This is something that has not been captured by any previous password strength or complexity measures, with the exception of [OWASP] Passfault"
@@ Line 116: / Line 118: @@
 * Cam Morris
 * New Jersey Institute of Technology students contributed to release 0.8 (Highlander):
 ** Michael Glassman

@@ Line 93: / Line 93: @@
     | colspan="2" align="center"  | [[File:Apache-feather-small.gif|link=http://www.apache.org/licenses/LICENSE-2.0.html]]
     |-
-    | colspan="2" align="center"  | [[File:Project_Type_Files_CODE.jpg|link=https://github.com/c-a-m/passfault]]
+    | colspan="2" align="center"  | [[File:Project_Type_Files_CODE.jpg|link=https://github.com/owasp/passfault]]
     |}
 |}

← Older revision		Revision as of 14:01, 27 October 2016
Line 62:		Line 62:
	== Quick Download ==		== Quick Download ==

−	[[https://github.com/~~c-a-m~~/passfault/releases downloads]]	+	[[https://github.com/owasp/passfault/releases downloads]]

← Older revision		Revision as of 21:43, 26 May 2016
Line 54:		Line 54:
	[[http://nakedsecurity.sophos.com/2012/05/25/how-long-would-it-take-to-crack-your-password/ Naked Security, Sophos]]		[[http://nakedsecurity.sophos.com/2012/05/25/how-long-would-it-take-to-crack-your-password/ Naked Security, Sophos]]

		+	== Research ==
		+	''General Framework for Evaluating Password Complexity and Strength'' [[http://arxiv.org/abs/1512.05814 Cornell University Library]]
		+	"...This is something that has not been captured by any previous password strength or complexity measures, with the exception of [OWASP] Passfault"

	\| valign="top" style="padding-left:25px;width:200px;" \|		\| valign="top" style="padding-left:25px;width:200px;" \|