LibraTool logoLibraTool

Hubiyaha Xoogga Password-ka oo Bilaash ah

Hubi intee in le'eg ay xoog u tahay password-kaaga adiga oo isticmaalaya falanqaynta entropy, qiyaasaha waqtiga jebinta, iyo liis faahfaahsan oo shuruudo ah. Wuxuu gebi ahaanba ka shaqeeyaa browser-kaaga.

Hubinta xooggu waxay ka shaqeysaa qalabkaaga oo keliya. Hubinta jabka ikhtiyaariga ah ee hoose waxay u dirtaa pwnedpasswords.com 5-ta xaraf ee ugu horreeya ee SHA-1 hash (weligeed erayga sirta ah laftiisa).

Qiyaasi ah oo kaliya. Dhibcuhu waa qiyaas ku salaysan qaab-dhismeedka iyo liisaska erayada sirta ah ee caadiga ah. Erayada sirta ah ee dhacay, hubinta jabka ee hoose waa tijaabo ka sii la isku halayn karta.

Sida Ay U Shaqeyso

Falanqaynta xoogga wuxuu gebi ahaanba ka shaqeeyaa biraawsarkaaga isagoo isticmaalaya injineer JavaScript oo gacan lagu qoray β€” laybreri, server midna ma jiraan. Wuxuu isku daraa xisaabta entropy-ga kaydka xarfaha, ogaanshaha qaabka (socodka kabuolboodhka, xarfo soo noqnoqda, beddello caadi ah), iyo raadin-jab ikhtiyaar ah oo isticmaasha API-ga Web Crypto iyo k-anonymity si password-kaagu aaladdaada uusan uga baxin.

  1. 1
    Entropy-ga kaydka waa la xisaabiyaa
    Markaad qorayso, qalabku wuxuu cabbiraa nooca xarfaha ee jira β€” kuwa yaryar (26), kuwa waaweyn (26), tirooyinka (10), calaamadaha (32) β€” wuxuu wadarta cabbirka kaydka ku dhufaa log2 si uu u helo bits entropy oo xaraf kasta, kadibna wuxuu ku dhufaa dherer password-ka. Password 10-xaraf ah oo dhammaantiis yar-eeyay wuxuu ka bilaabmaa qiyaastii 47 bits.
  2. 2
    Ciqaabaha qaabka waa la dabaqaa
    Entropy-ga qaawan waa kadib la yareeyaa qaab-dhismeed la saadaalin karo: socodka kabuolboodhka sida 'qwe' ama 'asd', socodyo isdaba-joog ah sida 'abc' ama '321', sannado afar-lambar ah (1900–2099), iyo socodyo xarfo soo noqnoqday mid kastaaba wuxuu qaataa 10 bits. Qalabku sidoo kale wuxuu rogaa beddellada l33t ee caadiga ah (@ β†’ a, 0 β†’ o, $ β†’ s) wuxuuna ka saaraa tirooyinka dambe si uu u helo 'P@ssw0rd1' sida password-ka la-yaqaan-caadiga-ah 'password' oo runtii ah.
  3. 3
    Dhibco iyo waqti-jab waa la go'aamiyaa
    Entropy-ga la hagaajiyay iyo liis-hubin sagaal-shay ah (dherer, noocyada xarfaha, socod aan la soo noqnoqon, ma aha password la-yaqaan-caadi-ah) ayaa wadajir go'aamiya dhibco laga bilaabo Aad U Daciif ah ilaa Xoog leh. Waqtiga jabku waa qiyaas iyadoo la mala-awaalayo 10 bilyan isku-day ilbiriqsi kasta β€” tiro caadi u ah weerarrada GPU-ga offline-ka ah β€” oo la xisaabiyo 2^entropy / 10,000,000,000.
  4. 4
    Hubinta jabka ikhtiyaarka ah via k-anonymity
    Haddii aad gujiso 'Ku hubi jabab la yaqaan', API-ga Web Crypto wuxuu si gudaha ah biraawsarka ugu sumeeyaa password-kaaga SHA-1. Kaliya 5-ka xaraf ee hex-ka ugu horreeya ee sumaddaas ayaa loo diraa API-ga Have I Been Pwned range; dabada waxaa lala barbardhigaa client-dhinac. Sumadda buuxda β€” iyo password-ka laftiisa β€” weligood kama baxaan aaladdaada.

Password-kaaga weligiis meel looma diro β€” dhammaan falanqaynta xoogga waxay ka socotaa gudaha JavaScript, hubinta jabka ikhtiyaarka ahna waxay isticmaashaa k-anonymity (kaliya 5-xaraf sumad-horgale ah ayaa loo diraa API-ga Have I Been Pwned, taasoo xisaab ahaan ka dhigaysa suuragal la'aan adeeggaas inuu dib u dhiso password-kaaga).

Qalabka La Xiriira

πŸ›‘οΈ

Hubiyaha Jebinta Ereyga Sirta

Hubi in erey sir ah uu ka soo muuqday jebin xog oo la yaqaan iyadoo loo marayo Have I Been Pwned β€” iyadoo la adeegsanayo k-anonymity, sidaa darteed ereyga sirta ah waxaa lagu hash-gareeyaa gudaha oo kaliya 5 xaraf oo hash bilow ah ayaa la diraa. Ereyga sirta ah laftiisu weligii kama tago browser-kaaga.

Isku day
πŸ”

Furaha Furaha

Samee ereyo sir ah oo adag, random oo leh dherer gaar ah, noocyada jilayaasha, iyo ka saarida. Ma xadidna, majiro gelitaan

Isku day
πŸͺΆ

Tiriyaha Xarfaha-Dhawaaqa

Tiri xarfaha-dhawaaqa (syllables) eray kasta iyo wadarta guud, oo leh heerka akhriska Flesch iyo heerka fasalka.

Isku day

Su'aalaha Inta Badan La Iska Weydiiyo