Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Password quality meter is too optimistic for the estimated entropy #359

Open
keepassium opened this issue Apr 12, 2024 Discussed in #358 · 0 comments
Open

Password quality meter is too optimistic for the estimated entropy #359

keepassium opened this issue Apr 12, 2024 Discussed in #358 · 0 comments
Labels
bug Something isn't working

Comments

@keepassium
Copy link
Owner

keepassium commented Apr 12, 2024

Description

The description and "quality meter" UI are overly optimistic for the password's entropy. For instance, a 9-letter password with estimated entropy of 48 bits is qualitied as "Weak" in KeePassXC, but "Very Good" in KeePassium.

How to reproduce
Steps to reproduce the behavior:

  1. Generate a short password in KeePassium's generator
  2. Paste the same password to KeePassXC's password generator
  3. Observe that KeePassium's qualitative description is much more optimistic than KeePassXC's

Expected behavior
KeePassium's description should be more realistic and similar to KeePassXC's.

Environment:

  • Device: any
  • OS: iOS 17
  • App Version: 1.52.149

Additional context

Originally reported by @RTClarkV in #358

Originally posted by RTClarkV April 12, 2024
KeePassium is great, don't get me wrong. One problem: The password strength checker sucks. It says a 9 character long, 48 bit password is "very good" with the green bars maxed out. This is misleading and bad. I would never trust a password of 48 bits, much less consider it "very good." Please change this. ANY other password manager I've used in the past like KeePassXC, PassBolt, and StrongBox think that a 48 bit password is laughable. The "very good" password indication should only be reserved for passwords of at least 120 bits. I don't know how you guys messed up this tiny thing in your really awesome password manager. Is this flaw normal or did I mess some setting up?

@keepassium keepassium added the bug Something isn't working label Apr 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant