Merge pull request owncloud#20 from owncloud/zxcbvn

Add zxcvbn

zxcvbn/LICENSE.txt

@@ -0,0 +1,20 @@
+Copyright (c) 2012 Dropbox, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

zxcvbn/README.md

@@ -0,0 +1,149 @@
+```
+_________________________________________________/\/\___________________
+_/\/\/\/\/\__/\/\__/\/\____/\/\/\/\__/\/\__/\/\__/\/\________/\/\/\/\___
+_____/\/\______/\/\/\____/\/\________/\/\__/\/\__/\/\/\/\____/\/\__/\/\_
+___/\/\________/\/\/\____/\/\__________/\/\/\____/\/\__/\/\__/\/\__/\/\_
+_/\/\/\/\/\__/\/\__/\/\____/\/\/\/\______/\______/\/\/\/\____/\/\__/\/\_
+________________________________________________________________________
+```
+
+`zxcvbn`, named after a crappy password, is a JavaScript password strength
+estimation library. Use it to implement a custom strength bar on a
+signup form near you!
+
+`zxcvbn` attempts to give sound password advice through pattern matching
+and conservative entropy calculations. It finds 10k common passwords,
+common American names and surnames, common English words, and common
+patterns like dates, repeats (aaa), sequences (abcd), and QWERTY
+patterns.
+
+For full motivation, see:
+
+http://tech.dropbox.com/?p=165
+
+# Installation
+
+``` html
+<script type="text/javascript" src="zxcvbn-async.js">
+</script>
+```
+
+is the best way to add `zxcvbn` to your site. Host `zxcvbn.js` and
+`zxcvbn-async.js` somewhere on your web server, and make the hardcoded
+path inside `zxcvbn-async.js` point to `zxcvbn.js`. A relative path works
+well.
+
+`zxcvbn-async.js` is a tiny 350 bytes. On `window.load`, after your page
+loads and renders, it'll fetch `zxcvbn.js`, which is more like 700k (330k
+gzipped), most of which is a series of dictionaries.
+
+I haven't found 700k to be too large -- especially because a password
+isn't the first thing a user typically enters on a registration form.
+
+`zxcvbn.js` can also be included directly:
+
+``` html
+<script type="text/javascript" src="zxcvbn.js">
+</script>
+```
+
+But this isn't recommended, as the 700k download will block your
+initial page load.
+
+`zxcvbn` adds a single function to the global namespace:
+
+``` javascript
+zxcvbn(password, user_inputs)
+```
+
+It takes one required argument, a password, and returns a result object.
+The result includes a few properties:
+
+``` coffeescript
+result.entropy            # bits
+
+result.crack_time         # estimation of actual crack time, in seconds.
+
+result.crack_time_display # same crack time, as a friendlier string:
+                          # "instant", "6 minutes", "centuries", etc.
+
+result.score              # [0,1,2,3,4] if crack time is less than
+                          # [10**2, 10**4, 10**6, 10**8, Infinity].
+                          # (useful for implementing a strength bar.)
+
+result.match_sequence     # the list of patterns that zxcvbn based the
+                          # entropy calculation on.
+
+result.calculation_time   # how long it took to calculate an answer,
+                          # in milliseconds. usually only a few ms.
+````
+
+The optional `user_inputs` argument is an array of strings that `zxcvbn`
+will add to its internal dictionary. This can be whatever list of
+strings you like, but is meant for user inputs from other fields of the
+form, like name and email. That way a password that includes the user's
+personal info can be heavily penalized. This list is also good for
+site-specific vocabulary.
+
+When `zxcvbn` loads (after the async script fetch is complete), it'll
+check if a function named `zxcvbn_load_hook` is defined, and run it with
+no arguments if so. Most sites shouldn't need this.
+
+# Development
+
+Bug reports and pull requests welcome!
+
+`zxcvbn` is written in CoffeeScript and Python. `zxcvbn.js` is built with
+`compile_and_minify.sh`, which compiles CoffeeScript into JavaScript,
+then JavaScript into efficient, minified JavaScript.
+
+For development, include these scripts instead of `zxcvbn.js`:
+
+``` html
+<script type="text/javascript" src="adjacency_graphs.js">
+</script>
+<script type="text/javascript" src="frequency_lists.js">
+</script>
+<script type="text/javascript" src="matching.js">
+</script>
+<script type="text/javascript" src="scoring.js">
+</script>
+<script type="text/javascript" src="init.js">
+</script>
+```
+
+Data lives in the first two scripts. These get produced by:
+
+```
+scripts/build_keyboard_adjacency_graph.py
+scripts/build_frequency_lists.py
+```
+
+`matching.coffee`, `scoring.coffee`, and `init.coffee` make up the rest of the
+library.
+
+`init.js` needs to come last, otherwise script order doesn't matter.
+
+I recommend setting up coffee-mode in emacs, or whatever equivalent, so
+that CoffeeScript compiles to js on save. Otherwise you'll need to
+repetitively run `compile_and_minify.js`
+
+
+# Acknowledgments
+
+Dropbox, thank you in so many ways, but in particular, for supporting
+independent projects both inside and outside of hackweek.
+
+Many thanks to Mark Burnett for releasing his 10k top passwords list:
+
+http://xato.net/passwords/more-top-worst-passwords
+
+and for his 2006 book,
+"Perfect Passwords: Selection, Protection, Authentication"
+
+Huge thanks to Wiktionary contributors for building a frequency list
+of English as used in television and movies:
+http://en.wiktionary.org/wiki/Wiktionary:Frequency_lists
+
+Last but not least, big thanks to xkcd :)
+https://xkcd.com/936/