Password complexity gems

rubyonrails-talk
1

Hey all,

A team of mine is adding a password complexity gem to a codebase of ours. Based on security advice, we’ve originally settled upon zxcvbn. However, as I’ve started to look into the gem itself it seems that it was started at Dropbox and that forward development has ceased. There are a number of forks but I believe zxcvbn now refers to one of the lesser used variants as opposed to say, zxcvbn-ruby.

I just wanted to ask if there is any concensus by the community on which one has a future and which one should actually be used? Or, if the concensus is to avoid zxcvbn altogether, what the best replacement would be?

Thanks!

2 Likes
3

I have made zxcvbn gem myself. By made I mean ported.

I tried using ‘zxcvbn-ruby’ for a while but at best it does not pro’duce same results as the js version from dropbox. Which, In my case, this was a requirement. But worse than that some results were just wrong and I did not see much movement to fix or improve the gem.

If you have spare server resources you could use ‘zxcvbn-js’ gem. This gem runs spins up an javascript runtime to get results directly from dropbox’s zxcvbn lib. This was considered and in my case and it was not ok to have javascript runtime running in production with all memory overhead just to check password complexity. It get the job (correctly) done, though.

Then i decided to port ‘zxcvbn’ from dropbox, and so I did. Line by line I converted it to Ruby. Chased all the zxcvbn-ruby’s complaints I could find online and all the result discrepancies I came across and made a spec for each of them.

That’s how I made zxcvbn gem compatible to dropbox’s one running only Ruby.

By the way, watch out for ports that do not take processing time into account. Dropbox zxcvbn was made to run on the client’s browser which makes it useless to DOS attacks. Same cannot be ignored if you run it on the server. Those attacks relate to testing longer passwords with special character sequences. I have made some improvements to avoid them on ‘zxcvbn’ but might be wise to truncate the password before testing it with any of the ports to mitigate this problem. Even with ports of other languages. It doesn’t seem they receive much attention around this aspect.

1 Like