Password must not compress too well using gzip #11
Conversation
|
This would require to change the type of the worker to |
|
Ah, do I need to use |
mithodin
force-pushed
the
feat/not-well-compressable
branch
from
424ef9f to
882f2f6
Compare
|
@troyhunt I see quite a few other PRs being merged since I opened this one, if you're not interested in this please lmk so I can stop keeping it mergeable. |
|
Hey @mithodin, sorry for not responding earlier. The main reason I've been hesitating on this one is that as more PRs have come in and more crazy conditions added, I've been thinking: what are the best criteria to infuriate, but also waste as much of the spammer's time as possible. To do this, we need to keep them engaged and if the criteria is too foreign to them (such as the compressability of data), that could kill their interest and prematurely end the time-wasting exercise. That said, I might have to revisit some of the existing contributions as well. I'm going to leave this one here for the moment, I just wanted to make sure I gave you a good explanation. Hope that makes sense. |
|
👍 thanks, makes sense. I'm not sure if a different wording for the message, like "Password entropy too low" or "Password too repetitive" would make it better? Could still make someone just quit, I guess. |
|
Not a good one, I think. The vast majority of people will think "what on earth does that mean?" and just give up |
| @@ -1,7 +1,25 @@ | |||
| const { gzipSizeSync } = require('gzip-size'); | |||
There was a problem hiding this comment.
Why do you need importing package which actually compresses data with zlib?
| const baseline = gzipSizeSync('a'); | ||
|
|
||
| function compressesTooWell(password) { | ||
| const size = gzipSizeSync(password); | ||
| return (size - baseline) < (password.length - maxAllowedCompression); | ||
| } |
There was a problem hiding this comment.
I think this will be a waste of computing resources. Instead we could just put RLE here for that
|
|
||
| return { | ||
| passwordIsInvalid: compressesTooWell, | ||
| message: `Password must not be too repetitive`, |
There was a problem hiding this comment.
I think this can be phased as Password must not have consecutive characters
No description provided.