lowe

heh, I included this line because it's true, but that whole section is about why "use coffee because you like python" is the wrong tldr.

nope! confusingly unrelated.

Sorry for the confusion, this was a forum release. Linux build is here:

https://forums.dropbox.com/topic.php?id=66910

here's the full context from dropbox forums: https://forums.dropbox.com/topic.php?id=66910

$^$^$^_ and $^$^$^z are both recognized by zxcvbn as bruteforce regions. it reports the entropy as:

n log (c)

for a length-n password with symbol space c. the huge difference in crack time is because zxcvbn is using c==33 (symbols only) for $^$^$^_ and c==59 (symbols + a-z) for $^$^$^z

$^$^$^i is in the middle -- 'i' is considered a dictionary match, the rest is c==59 bruteforce.

the bigger problem is $^$^$^ isn't recognized as a pattern, but i'm working on ways to improve bruteforce estimation too. good example!

zxcvbn's current analysis for 'correcthorsebatterystaple' vs 'correct horse battery staple' looks about right to me, it's counting each space as an extra bruteforce character.

horsebattery vs 'h orsebattery', on the other hand, shows a clear flaw -- it doesn't tolerate misspellings up to a given edit distance. edit distance is tricky because efficient word segmentation gets much harder, especially w/ support for l33t substitutions.

'abcde' vs 'a b c d e' is tricky too. i could add special case for spaces only that would allow zxcvbn to recognize 'a b c d e' as a sequence, but it wouldn't cover 'a-b-c-d-e', 'a8b8c8d8e' etc.

zxcvbn gives high entropy for emails because it isn't matching against them currently. if there's good evidence that people commonly use emails as passwords (and crackers try emails as guesses!) it'd be a great pattern to add.

That's a great idea. More generally, whatever the approach, I agree zxcvbn would be better with a more conservative rating for non-pattern-matched regions.

This drives me insane. It especially bites everyone using a a manager to generate long random passwords.

Password fields that are too short cause a similar problem, where you ask "am i still typing? did it cut me off?"

We purposely made the fields huge to help with this on: https://www.dropbox.com/register

It certainly needs more tweaking. FJ, FJFJ, etc isn't in any of the 10k passwords people commonly use, isn't a sequence, isn't a single repeated character, etc, so zxcvbn recognizes it as bruteforce.

A fun extension would be to recognize repeated chunks in addition to single characters.

sounds about right. screenshot of BofA's policy here: http://dl.dropbox.com/u/209/bofa_password_constraints.png

the forbidden list is: $ < > ^ ! [ ]

I'm with you. These two are great too:

* pole

* biosphere

combine these points with public high school budget cuts and it just gets worse. i still remember how demotivating it was being handed a heavy chemistry textbook from three decades ago on the first day of my junior year. the first 5 minutes alone flipping through those pages was probably what killed all interest in science for 19/20 in that class...i mean the authors were out of touch with teenagers even back in the 70s. so my biggest problem with textbooks has been their age: that has been the most significant in making a subject seem static and dead.

i've had CS and foreign language profs who used their own course notes updated yearly, and i ended up relying on these more than any prescribed textbook. the freshness made a big difference. the profs were also more invested in the material because they either wrote it themselves, or at least took the time to assemble. as such they were clued in to the contents and focused on them in lecture. a batch of notes also has less perceived authority than a textbook, which i think is a good thing, as it encourages questions and challenges.

I've found Bob Marley's soothing island rhythms, pitch-adjusted to 60bpm where necessary, go a long ways towards neutralizing the bad taste.

I've found my own effective method for beating that exhausted feeling: I call it "supercharging" your batteries. The trick is to down two or three redbulls immediately before going to sleep. 45-50 minutes later you basically hit the ceiling, transitioning in seconds from unconsciousness to compulsive jabbering. be careful with this technique: if you're unable to fall asleep before the medicine kicks, you're screwed.

The author maintains that fats and cheap carbs can only interrupt the body and add to its exhaustion. I think this is true only if you fail to shoot the moon.

i'm pretty sure a computer could rock this job. just wire up a natural language generator, make it jabber incessantly about stuffed crust pizza, throw in some 70s surfer slang (radical!), good to go.

with exercise i've found benefit as a function of time to be crazy non-linear. there's a much bigger difference between 0 minutes and 20 minutes spent exercising than between 20 and 40 or 40 and 60. so when i'm busy, i do what i can, keep it short, but never cut it out. i try to do something every other day at least. it clears my head and resets my stress.

i like to run. simple. no gym membership. no complicated/expensive gear -- only necessary investment is a pair of running shoes (runs around $90). best of all, you can exhaust yourself quickly: if you don't have much time to spare, just run faster* for less time.

* i wouldn't recommend taking this to an extreme. i knew a guy in college who'd max out the treadmill for a few minutes, sweat like crazy and call it a day. odds are that's terrible for you. (he also had an anger management problem...related?)