Discrepancy in password score between this version and the original package

[TheAlexPorter]

Hi all,

I'm using zxcvbn4j on the backend and the original zxcvbn from dropbox on the front end. When I use the following example password, I get two different scores.

Password: Sigma@123

With zxcvbn4j I get 2, but with zxcvbn I get 3. If we use the demo tool, we can see that 3 is the expected score.

Any thoughts on how we can get this library to match the original version's output?

[Stephen2]

Agree 👍 replicated using 1.3.0 and 1.3.4

[vvatanabe]

I'll investigate.

[TheAlexPorter]

Hi all, any update on this? Were you able to replicate the issue @vvatanabe?

[vvatanabe]

@TheAlexPorter Yes, I able to replicate this issue. But we're still investigating the cause.

[mrFloony]

@vvatanabe, I briefly compared the processing of zxcvbn4j and zxcvbn dropbox (demo tool in https://lowe.github.io/tryzxcvbn/)
In the demo tool, the password Sigma@123 is divided into "Sigma@" ('bruteforce') and "123" ('sequence').
In the zxcvbn4j, the password is divided into "Sigma" ('dictionary') and "@123" ('spatial').

Therefore, it is not known which result from the libraries will be considered correct, since 'bruteforce' is not very suitable for dropbox.

[Emi75]

We have the same issue in the latest version - dropbox/zxcvbn#320
@vvatanabe Any feedback on this issue or the project is not still mantained?
Thanks in advance.

[vvatanabe]

@Emi75 Sorry, I have too much scheduled and it's hard to make time. I need some help ;D

[vvatanabe]

@TheAlexPorter @Stephen2 @mrFloony @Emi75
Sorry for the wait! It took longer than expected, but I was able to fix this issue! Please use version 1.8.1.
https://github.com/nulab/zxcvbn4j/releases/tag/1.8.1

[Stephen2]

Thank you @vvatanabe :)