Hacker News new | ask | show | jobs
by fasterdom 2535 days ago
Indeed, replacing this with the list of top 100 passwords would be much more effective.
3 comments
cyphar 2535 days ago
Or, alternatively, switching to the haveibeenpwned API[1] or zxcvbn[2].

[1]: https://haveibeenpwned.com/API/v2 [2]: https://github.com/dropbox/zxcvbn

link
alister 2535 days ago
It seems to do that too (comparing against a list of the top 500 passwords):

https://github.com/bdmac/strong_password/blob/master/lib/str...

link
senorprogrammer 2535 days ago
A long time ago I made a gem that does pretty much this: https://github.com/senorprogrammer/pil

If you want this functionality, I recommend not using it as-is, given the security vuln GitHub is currently reporting. Rather, anyone has my permission to copy the code verbatim into your project. It's a pretty simple gem.

link