Hacker News new | past | comments | ask | show | jobs | submit login

It's somewhat ironic that this readme quotes an image that argues how counting character classes gives an incredibly distorted view of how complex a password is but then goes on to somehow completely miss the point and basically just count the character classes and the password length (which then proves the point of the xkcd comic by overestimating the ~28 bits of entropy password to have over 65 bits of entropy).

And the fact that this gives 'password123' a whole 51 bits of entropy should be a sign that it's an oversimplification. In fact if it wasn't for the fact that repeated characters are eventually ignored it would at least be guaranteed to always overestimate the entropy, as it is now it just punishes the use of long passwords using a small set of characters (again going directly against the quoted xkcd comic).




I submit that your password has roughly zero bits of entropy, if it is found in the Pwned Passwords list, or any other well-known list of passwords.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: