userInputs not taken into account when password is complex enough ?

[paulverbeke]

Hi @MrWook
Now that I know how to properly use the userInputs dictionnary I found a weird edge case.
I'm setting these options:

const options = {
    translations: zxcvbnts['language-fr'].translations,
    graphs: zxcvbnts['language-common'].adjacencyGraphs,
    dictionary: {,
        ...zxcvbnts['language-common'].dictionary,
        ...zxcvbnts['language-en'].dictionary,
        ...zxcvbnts['language-fr'].dictionary,
        userInputs: ['[email protected]']
    },
}
zxcvbnts.core.ZxcvbnOptions.setOptions(options)

calling with this password:

zxcvbnts.core.zxcvbn("[email protected]")

and getting a result with a score of 0 and the correct suggestion.

Now I test this password

zxcvbnts.core.zxcvbn("[email protected]")

and I get a result with a score of 4 and no suggestions, even though there's the user email address inside the password.
Is it normal behavior because the password is really in a way much more complex ?

[MrWook]

Hey, yes this is the normal behavior.
You will only get warnings/suggestion if the scoring is less or equal 2

[paulverbeke]

great thanks

[paulverbeke]

but is that advisable ? I mean, does zxcvbn handles userInputs the same way ? Because I would hate to find out that my users use passwords containing the name of the app/website even thought the password is strong

[MrWook]

Yes it is because zxcvbn will rate the different parts of a password and give them a guess count which will result in a scoring in the end.
[email protected] is something completely different than just the email address.

Why would you bother if something from the app is inside the password if it is strong?

[paulverbeke]

You're right. What I said is completely illogical, I must have been tired. If it's definitely too strong to guess, it doesn't matter one bit whether there's user inputs or not. Less friction for the end user like this