Password Strength Meters Put to the Test

[Guest_Jim_*]

Chances are you have created a password somewhere on the Internet, and there is even a good chance that you were presented with a strength meter of some kind. These are a fairly common tool for encouraging users to create strong passwords by indicating how strong one may be, but just how strong are the meters? Not very, according to researchers at Concordia University, who tested meters for multiple systems, including Google, Yahoo!, Dropbox, Twitter, and Skype, as well as some password managers.

What the researchers found is significant inconsistencies across these services as some would declare a password strong while another would say it is weak. They also found inconsistencies with what was acceptable, as one service may demand multiple character sets be used (letters, numbers, and symbols) while others would be okay just letters. The researchers point out that such weaknesses and inconsistencies can confuse users and make it harder for them to develop actual, stronger passwords. One suggestion the researchers have is to use something at least similar to Dropbox's strength meter, which actually compares passwords against a dictionary and marks any commonly found word as weak, thereby prompting users to be a bit more creative.

The researchers did contact the various companies they tested about their study, but even a year later, significant changes have not been made. Still though, perhaps with this study it may be possible to develop better strength meters for the future.

Source: Concordia University

[ir_cow]

yeah passwords are super weak. I used this program once when I forgot the password on a rar file and it cracked it under 5 seconds. It wasn't even a real word!