-
Notifications
You must be signed in to change notification settings - Fork 56
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fixed issue with exclusion dictionary not matching partial passwords.
Fixed another issue related to how dictionaries can be built. We only support lower case words in the dictionary and do case insensitive matching based on that. There was nothing obvious stopping a user from using upper case without even knowing though. I added a builder class to fix that issue and updated the readme to reflect that. I added test cases to test exclusion dictionaries, and reformatted any classes which were out of what the coding standard calls for.
- Loading branch information
Showing
13 changed files
with
189 additions
and
58 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -81,7 +81,7 @@ Password #2, while not allowed by our policy, is only susceptible to a brute for | |
<dependency> | ||
<groupId>me.gosimple</groupId> | ||
<artifactId>nbvcxz</artifactId> | ||
<version>1.3.2</version> | ||
<version>1.3.3</version> | ||
</dependency> | ||
``` | ||
|
||
|
@@ -90,7 +90,7 @@ Password #2, while not allowed by our policy, is only susceptible to a brute for | |
|
||
### Standalone | ||
To use as a stand-alone program, just compile, and run it by calling: | ||
`java -jar nbvcxz-1.3.2.jar` | ||
`java -jar nbvcxz-1.3.3.jar` | ||
![alt text](http://i.imgur.com/9c070FX.png) | ||
|
||
### Library | ||
|
@@ -99,27 +99,23 @@ Below is a full example of the pieces you'd need to implement within your own ap | |
##### Configure and create object | ||
|
||
###### All defaults | ||
```java | ||
``` | ||
// With all defaults... | ||
Nbvcxz nbvcxz = new Nbvcxz(); | ||
``` | ||
|
||
###### Custom configuration | ||
Here we're creating a custom configuration with a custom exclusion dictionary and minimum entropy | ||
```java | ||
``` | ||
// Create a map of excluded words on a per-user basis using a hypothetical "User" object that contains this info | ||
int i = 0; | ||
HashMap<String, Integer> excludeMap = new HashMap(); | ||
excludeMap.put(user.getFirstName(), i++); | ||
excludeMap.put(user.getLastName(), i++); | ||
excludeMap.put(user.getEmail(), i++); | ||
// And more... | ||
|
||
// Create a dictionary list containing all the default dictionaries | ||
List<Dictionary> dictionaryList = ConfigurationBuilder.getDefaultDictionaries(); | ||
|
||
// Add our new exclusion dictionary to the list | ||
dictionaryList.add(new Dictionary("exclude", excludeMap, true)); | ||
dictionaryList.add(new DictionaryBuilder() | ||
.setDictionaryName("exclude") | ||
.setExclusion(true) | ||
.addWord(user.getFirstName(), 0) | ||
.addWord(user.getLastName(), 0) | ||
.addWord(user.getEmail(), 0) | ||
.createDictionary()); | ||
// Create our configuration object and set our custom minimum | ||
// entropy, and custom dictionary list | ||
|
@@ -135,7 +131,7 @@ Nbvcxz nbvcxz = new Nbvcxz(configuration); | |
##### Estimate password strength | ||
|
||
###### Simple | ||
```java | ||
``` | ||
This comment has been minimized.
Sorry, something went wrong.
This comment has been minimized.
Sorry, something went wrong.
Tostino
Author
Collaborator
|
||
// Estimate password | ||
Result result = nbvcxz.estimate(password); | ||
|
@@ -145,7 +141,7 @@ return result.isMinimumEntropyMet(); | |
###### Feedback | ||
This part will need to be integrated into your specific front end, and really depends on your needs. | ||
Here are some of the possibilities: | ||
```java | ||
``` | ||
// Get formatted values for time to crack based on the values we | ||
// input in our configuration (we used default values in this example) | ||
|
@@ -201,7 +197,7 @@ else | |
We have a passphrase/password generator as part of `nbvcxz` which very easy to use. | ||
|
||
###### Passphrase | ||
```java | ||
``` | ||
// Generate a passphrase from the standard (eff_large) dictionary with 5 words with a "-" between the words | ||
String pass1 = Generator.generatePassphrase("-", 5); | ||
|
@@ -210,7 +206,7 @@ String pass2 = Generator.generatePassphrase(new Dictionary(...), "-", 5); | |
``` | ||
|
||
###### Password | ||
```java | ||
``` | ||
// Generate a random password with alphanumeric characters that is 15 characters long | ||
String pass = Generator.generateRandomPassword(Generator.CharacterTypes.ALPHANUMERIC, 15); | ||
``` | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
2 changes: 1 addition & 1 deletion
2
src/main/java/me/gosimple/nbvcxz/matching/match/DictionaryMatch.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
64 changes: 64 additions & 0 deletions
64
src/main/java/me/gosimple/nbvcxz/resources/DictionaryBuilder.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,64 @@ | ||
package me.gosimple.nbvcxz.resources; | ||
|
||
import java.util.HashMap; | ||
import java.util.Map; | ||
|
||
/** | ||
* Dictionary builder class to help properly build dictionaries. | ||
*/ | ||
public class DictionaryBuilder | ||
{ | ||
private String dictionary_name; | ||
private Map<String, Integer> dictonary = new HashMap<>(); | ||
private boolean exclusion; | ||
|
||
/** | ||
* Set the dictionary name | ||
* | ||
* @param dictionary_name unique name of dictionary. | ||
* @return the builder | ||
*/ | ||
public DictionaryBuilder setDictionaryName(final String dictionary_name) | ||
{ | ||
this.dictionary_name = dictionary_name; | ||
return this; | ||
} | ||
|
||
/** | ||
* Set if exclusion dictionary or not. | ||
* | ||
* @param exclusion {@code true} when desiring to disallow any password contained in this dictionary; {@code false} otherwise. | ||
* @return the builder | ||
*/ | ||
public DictionaryBuilder setExclusion(final boolean exclusion) | ||
{ | ||
this.exclusion = exclusion; | ||
return this; | ||
} | ||
|
||
/** | ||
* Add word to dictionary. | ||
* | ||
* @param word key to add to the dictionary, will be lowercased. | ||
* @param rank the rank of the word in the dictionary. | ||
* Should increment from most common to least common if ranked. | ||
* If unranked, an example would be if there were 500 values in the dictionary, every word should have a rank of 250. | ||
* If exclusion dictionary, rank is unimportant (set to 0). | ||
* @return the builder | ||
*/ | ||
public DictionaryBuilder addWord(final String word, final int rank) | ||
{ | ||
this.dictonary.put(word.toLowerCase(), rank); | ||
return this; | ||
} | ||
|
||
/** | ||
* Creates the dictionary. | ||
* | ||
* @return the dictionary | ||
*/ | ||
public Dictionary createDictionary() | ||
{ | ||
return new Dictionary(dictionary_name, dictonary, exclusion); | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Just curious: why are you removing these language markers?