-
Notifications
You must be signed in to change notification settings - Fork 0
Description
Problem statement
After generating a password the user should see an indication of its strength. Apple's Keychain has four categories (Weak, Fair, Good, Excellent), could do something similar or only have 3 categories.
The catch here is to incorporate note just the log_2(1024) = 10 bits per three-letter-prefix part of the password strength, but also avoid too-short passwords by estimating the character-based entropy of the password. I expect that passwords under 10 characters long will always be too weak and we should always say they're weak, regardless of how many words are in the password.
Consider also incorporating https://github.com/dropbox/zxcvbn to avoid obviously-bad passwords. Just because we're generating random three-letter prefixes doesn't mean we, by mistake, generate a password that happens to be a few English words.
This is an interesting issue because it will involve updating both the Rust library (to do the new password strength estimation and return it to the caller) and Flutter changes (to use the new password strength estimation to render some widget).
Acceptance criteria
- As a user when I generate a password I see an estimate of its strength.
- The help screen tells users what situations require different kinds of password strengths.