Encrypted Com Services Should Confirm Password Strength To Both Parties

[Kepler_452b 77]

Encrypted Com Services Should Confirm Password Strength To Both Parties. Services like Protonmail, Tutanota, Wire, etc should confirm the password strength of communication partners to each other. After all, the security of your communication to someone is only as good as their password if their device is compromised or intercepted. This also might encourage people to use strong passwords.

[zhang888 1065]

How exactly should those (or any other self-respecting service, for that matter) know that your or your partners password is not strong?

All of them store the passwords in a salted hash form, with key stretching known as PBKDF2, which iterates the plaintext thousands of times

in order to deliberately consume more computing power for the final hash. which makes them hard or practically impossible to brute/rainbow

even if the DB is compromised.

 

The only time the service knows your plaintext password is during signup, and even then not necessary - good privacy aware services do

the initial hashing on the client side using JS, so since the first registration the service never knows your plaintext password, and it should better

be this way.

[Kepler_452b 77]

I totally agree that the service should NOT know your password. But at the time of signup a measure of quality of password is often generated which could be kept and shared without knowing the password. Likewise if a password is changed.

[zhang888 1065]

If you are talking about that little JS function that gives you a score based on lower/uppercase characters, length and numbers it was proven to have

very little practical security. Do you agree that the password "iamzhang" is much better than "P@ssw0rd"? Same idea goes there.

And all password validators will prefer the second option as the strongest password ever

[Kepler_452b 77]

That little JS function is merely a simple example. "P@ssw0rd" or "iamzhang" could probably be cracked in a few flops. But It shouldn't be hard for smart coders to put together an effective measure of password strength based on measured entropy.