Evilpass
Security and privacy
password strength checker
SHOW HN2017
How HN took it
8 positive, 8 neutral or asking, 0 mixed, 10 critical, out of 26 comments about the project. Thread score -0.06.
Idea: 8 for, 7 againstPrivacy: 0 for, 2 againstExecution: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Clever, funny idea that makes the password reuse point well
From 4 comments
By mere virtue of showcasing the irony in providing passwords and their re-use I must tip my hat to you. You have done more as a security activist with a simple project than most…
sova on HNMy favorite part of this is https://www.xkcd.com/792/
taf2 on HNI like it. Evil enough. I'll steal the idea.
rootsudo on HNI thought it was going to run the user through a wild goose chase of eccentric and varying password requirements. This was better.
dkokelley on HN
Objections
Server-side logins to Twitter and Facebook could trigger security alerts and privacy concerns
From 2 comments
This server-side call to Twitter, Facebook etc is a bad idea. I understand you are trying to educate your users with a nice UX but let's say this software is running on USA but…
jfroma on HNWouldn't doing something like this on a live site constitute as a social engineering hack? Hope the author of the projects leaves a very visible warning to anyone who might…
malikNF on HN
Possible legal issues with testing others' passwords without authorisation
From 1 comment
I understand the rationale. This would upgrade the level of a security of any given website. I wonder... Can a third party launch a script testing my passwords without prior…
atmosx on HN
Code has a bug with email and username arguments swapped
From 1 comment
Email and username are transposed compared to the site check function signatures. I'm sure someone will send a pull request to fix that and make it slightly less un-evil. To be…
biot on HN
Requests
Fix the swapped email and username arguments
From 1 comment
Email and username are transposed compared to the site check function signatures. I'm sure someone will send a pull request to fix that and make it slightly less un-evil. To be…
biot on HN
Questions
Is this slightly evil, or just a demonstration?
From 1 comment
This is an interesting concept. It gets me thinking: what exactly makes this "slightly evil"? It's not actually doing anything nefarious. It checks to see if it can use your…
mikeash on HN
Alternatives named
zxcvbn password strength estimator
From 1 comment
An actually-useful alternative: https://github.com/dropbox/zxcvbn
bjt on HN
Diceware passphrases
From 2 comments
Just use diceware.
Spooky23 on HNEnter Diceware: http://world.std.com/~reinhold/diceware.html
andreareina on HN