Duplicati: Javascript Passphrase Strength Tester Freezes UI on Long Passphrases

[jonmchan]

• [x] I have searched open and closed issues for duplicates.

---

Environment info

• Duplicati version: 2.0.3.3_beta_2018-04-02
• Operating system: MacOS 10.12.6
• Backend: NA

Description

The UI freezes when a long passphrase is inputted. After 30-60 seconds, the UI unfreezes and verifies the password is strong.

Steps to reproduce

1. Add Backup.
2. Put 'kl;5;=Vm-Tb>{8N}e]hb+M;Fu8.s9u#D):c19/;(4b)%KGMg4{ylMd1IGXP||>>y_[}
3. Watch it freeze.

• Actual result:
  Freeze
• Expected result:
  256 character password should not freeze ui.

Screenshots

Debug log

[Pectojin]

Hmm, interesting.

It seems to be more dependant on complexity rather than length. 256 a's in a row clears the check almost instantly. repeating "abcdefg" for 256 characters is a little slower. Adding special characters in seems to slow significantly more.

I'm guessing it's just the password estimation tool that handles it poorly. It's borrowed from here:
https://github.com/dropbox/zxcvbn

If I trim your passphrase to 100 characters it takes 1-2 seconds to validate, so I thinking it may be a reasonable "fix" to just not check passwords over some arbitary length, e.g. 100 characters. Even fairly simple 100 character passwords are tough to crack.

[bwong00]

I'm not sure if you saw this in the documentation, or just arbitrarily chose 100 characters, but the documentation for zxcvbn, under the Runtime Latency section, states:

zxcvbn operates below human perception of delay for most input: ~5-20ms for ~25 char passwords on modern browsers/CPUs, ~100ms for passwords around 100 characters. To bound runtime latency for really long passwords, consider sending zxcvbn() only the first 100 characters or so of user input.

So I think it's safe to say that they concur with your assessment.

[Pectojin]

Lucky guess from a little testing :)

[Pectojin]

I added a PR to fix this. I opted to use their suggestion to validate the password, but just cropping it at 100 characters.