I’d love to know the algorithm that decides whether a password is weak or not.
About 60% of my passwords are marked as ‘weak’. I have 14 character, mixed case, alphanumeric passwords marked as ‘weak’ when I think they’re absolutely not.
94^14 is about 4.22 x10^27 possible permutations. So best case scenario, a threat actor trying a billion permutations per second finds the right combination at the half way point, taking about 67 million years.
And that’s just an offline brute force attack, whereas most reputable online services will have throttling, lockouts, MFA etc.
In what reality is 67 million years not considered an acceptable cover time and why is proton saying this is ‘weak’?
I like the app but, honestly, get real with the warnings about password being weak or at least give us the options to turn that off.