Standardizing of password strength algorithm

Question

Last couple of months I've been wondering about all these password strength meters on websites. If you use the same password in every of those registration forms, the result on meter is sometimes different. One say "Strong" other say "Normal" and there are probably some that would even say "Weak".

So the question is, what if there would be a standard, that would be used by programmers in their work, to make it a little bit less confusing and sometimes annoying?

And if you say yes and no, please give an argument or two.

Thanks!

P.S. Not sure if this have been discussed before, please be cool if this is a "repeat".

Edit

Looks like the question has been compromised. I wasn't thinking of starting a discussion about password strengths. To be honest, every password can be stolen, just need the proper tools.

It's not about security in one site or another. I haven't actually seen a bank website utilizing any kind of security measures, they do everything on their own to make it unique, probably.

Lets give it one more shot.. If there was a campaign, where programmers show their code for their method and others would have to vote, following some voting guidelines, like: you have to judge simplicity, compatibility and security.

Then, the winning method (voted by programmers) would be picked as "standard" method and popularized to be used in forms.

Do you see any use in that kind of method, and if you do, would you use it?

Answer 1

From Wikipedia:

The strength of a random password can be calculated by computing the information entropy. If each symbol in the password is produced independently, a password's information entropy is given by the formula:

where N is the number of possible symbols and L is the number of symbols in the password. The function log2 is the base-2 logarithm. H is measured in bits.

The calculation is detailed on the Wikipedia page.

Answer 2

Standardizing the strength of passwords using relative terms like "weak" and "strong" is kind of like standardizing the strength of a lock using similar terms. You can't measure "weak" or "strong"; what you can measure is how long it would take to break (similar to security ratings on physical locks/safes), acceptable tolerances of candidate keys (how close does a fingerprint, or key grinding, have to be to the original sample the lock was keyed to in order to work), etc.

Fredley's algorithm will give you a number. That number can be compared to any other, and much like any measurement you can quantify relative strength or weakness. As for defining standards like "X is weak", "Y is normal", I don't think you'll get all interested parties to agree, because the absolute strength of a key must always be taken in reference to the value of the resource it protects. You (or your daughter) wouldn't put her diary in a safe deposit box at the bank behind a vault door; an 80-cent toy lock would provide "strong" security against those she didn't want reading it (snot-nosed little or big brother, sleepover guests, etc). However, that 80-cent toy lock wouldn't last two seconds on the door of your safe deposit box, where the deed to your house, the title to your car, and your great-grandmother's one-off 25-carat diamond necklace are kept.

Similarly, the password (or more accurately the compound security measure) required for a bank website will be stronger than for an online forum because the resource it protects has more material value. The forum's just words (though there are some famous cases of Facebook hacking resulting in compromising photo leaks); if a hacker gets into your bank records, they can seriously ruin your life.

So, "MittensABC" would be an acceptable password for most forums because it's longer than 8 characters (26^8 = roughly 208 billion combinations of random letters) and contains uppercase and lowercase letters (the sample space required to "brute-force" this password would be 52^10 = 144 quadrillion possible combinations of 10-character case-sensitive strings). However, it would be totally inadequate for a bank: it is made up primarily of a dictionary word, and is different only because you added an easy-to-guess letter combination, so an "intelligent" cracking alg could reduce the initial sample space to the 100k or so words in modern usage, and append basic letter and number strings to come up with maybe a couple million possibilities (child's play for a computer to churn through). By the same token, many sites that offer access to very private information don't allow use of birthdays, SSNs, etc. in passwords, since if that information were stolen it could be given as hints to a cracking algorithm, further reducing the initial likely sample space.

In summary, what makes a "good" password depends on how likely a hacker/cracker will be to persist at trying to break that password. There are other useful tools like a 10-second cooldown between login attempts, or a certain number of attempts in a 15-minute period, which make it virtually impossible to leverage the speed of a computer, but an intelligent algorithm, a website vulnerability, or a dumb user can all increase the chances of a successful hack.

Answer 3

Do you want a theoretical answer to measure the strength or some practical implementation that's more-or-less a de-facto standard?

If it's the latter, there are some good links from this old question

• http://stackoverflow.com/questions/1614811/how-do-i-measure-the-strength-of-a-password

and some jQuery plugins that are probably de-facto standards, e.g.

• http://phiras.wordpress.com/2009/07/29/password-strength-meter-v-2/
• http://projects.sharkmediallc.com/pass/

because they're available and easy to drop in, even if there isn't any cited research behind the strength algorithms. The obvious omission with these is a dictionary check to make sure you haven't used something from or simply based on a dictionary word, which may well require a server-side implementation to do well. (Which is OK, I guess, since you're ultimately sending the password you compose to the same server.)