Skip to content

Password strength indicator #7

@asimihsan

Description

@asimihsan

Problem statement

After generating a password the user should see an indication of its strength. Apple's Keychain has four categories (Weak, Fair, Good, Excellent), could do something similar or only have 3 categories.

The catch here is to incorporate note just the log_2(1024) = 10 bits per three-letter-prefix part of the password strength, but also avoid too-short passwords by estimating the character-based entropy of the password. I expect that passwords under 10 characters long will always be too weak and we should always say they're weak, regardless of how many words are in the password.

Consider also incorporating https://github.com/dropbox/zxcvbn to avoid obviously-bad passwords. Just because we're generating random three-letter prefixes doesn't mean we, by mistake, generate a password that happens to be a few English words.

This is an interesting issue because it will involve updating both the Rust library (to do the new password strength estimation and return it to the caller) and Flutter changes (to use the new password strength estimation to render some widget).

Acceptance criteria

  • As a user when I generate a password I see an estimate of its strength.
  • The help screen tells users what situations require different kinds of password strengths.

Metadata

Metadata

Assignees

No one assigned

    Labels

    P1Priority 1 - Not a launch blocker but urgent issue.UXUser experience / user interfaceflutterRelates to Flutter/Dart codepasswordgenAffects the Rust library implementation

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions