[0.2] Ext.ux.PasswordMeter

[jheid]

Really nice.

Perhaps it would nice if you can plug in your own algorithm. Acutally I'm thing about using Google for password strength judgement. The only problem is that - as far as I know - you can contact the google search just via HTTP, but this would be a nice way to get rid of simple passwords....

[JeffHowden]

I would seriously reconsider the use of Google.

http://extjs.com/forum/showthread.ph...ngth#post48251

[Pagebaker]

Indeed it doesn't look so powerful.. and you'll need to send the password over the net, unencrypted..

Hm i didn't know someone else already build a passwordmeter, oh well it's a good lesson for me

[JeffHowden]

UI-wise, yours is better.

[jheid]

I would seriously reconsider the use of Google.

http://extjs.com/forum/showthread.ph...ngth#post48251

I'm not talking about using the Google JavaScript files for password strength but the simple web search, so that a password with fewer hits is much better than a password with many hits. The problem is that afaik the Google search doesn't support SSL.

[JeffHowden]

That's a creative approach, but fewer hits probably isn't as indicative of a strong password as you might think. For example, mysuperstrongpassword returns no records, but is clearly not a strong password by any stretch of the imagination. Additionally, even if they did support SSL, queries are still sent via the query string rendering SSL useless:

http://www.google.com/search?hl=en&q...strongpassword

[jheid]

That's a creative approach, but fewer hits probably isn't as indicative of a strong password as you might think. For example, mysuperstrongpassword returns no records, but is clearly not a strong password by any stretch of the imagination. Additionally, even if they did support SSL, queries are still sent via the query string rendering SSL useless:

http://www.google.com/search?hl=en&q...strongpassword

Yes, you're right. It would just be a good way to check against a dictonary and simple password like 'abcd123'.

[JeffHowden]

There are dictionary webservices available. Even those aren't terribly helpful though as the algorithm needs to check possible strings within the password against word lists. A version I built by reverse engineering the MSN one does exactly that, but the word lists are hard-coded.

http://jeffhowden.com/code/coldfusio...word_strength/

This example uses server-side logic to measure password strength and AJAX calls to query the server-side system.

[tjstuart]

Additionally, even if they did support SSL, queries are still sent via the query string rendering SSL useless

Pretty sure that is incorrect. The query string is protected by SSL. See here

http://answers.google.com/answers/th...=758002#answer

[JeffHowden]

Pretty sure that is incorrect. The query string is protected by SSL. See here

http://answers.google.com/answers/th...=758002#answer

Indeed, not completely useless. However, the password is exposed locally in the browser's cache/history. So, to those who don't want their password exposed, it's still a good idea to not send it over the wire in the query string, SSL or not.

Bottom line, if the data is sensitive, then POST and SSL in combination is the only option.