For those of you who might have missed my previous entry and the history behind passwordmeter.com, feel free to read about it here. For the rest of you, you’ll be happy to know that I finally got around to adjusting the algorithms in the Password Meter script. My original update was to be a single html page with javascript, css and even images embedded. This would have made it really easy to download and deploy in virtually any environment. However, due to a lack of support for base64 image conversion in earlier versions of Internet Explorer, I was forced to include a separate directory for images. Since I had to create a separate directory for images, I opted to extract the Javascript and CSS code as well, and place each into its own respective directory. So the final download is actually a zip file that contains the main page and all supporting scripts, images and stylesheets, plus a copy of the GPL license.

In addition to generally cleaning up the code a bit and adding penalties for repeat symbols, the main update to the script was done to alter the method used to calculate deductions for repeat characters. This has been an issue since version 1.03 was deployed and was never addressed until now. I originally used an exponential formula to penalize users for adding the same character more than once to their password. As the number of identical characters increased, the penalty became more and more severe – to the point where users would end up with a score of zero, despite having a reasonably difficult password. I realized the flaw shortly after I deployed it but never got around to fixing it due to other projects getting in the way.

In the latest version, repeat characters are still penalized. But the formula is now based on proximity to other identical characters where further distance means less deduction. I also accounted for the total number of unique characters and weighed that number into the calculation as well. So if you have a 12 character password that consists entirely of unique alpha-numerics and symbols, then add a string of 14 “x”s to the end, the deduction penalty for the repeat characters is significantly reduced. Being that the password meter utility is run entirely on the client side, I’m still limited to the tools that Javascript can provide, so it’s still not quite as accurate as I’d like it to be. But this new version should be a lot more accurate than the previous releases in terms of applied penalties and total score calculation.

I am planning to rebuild the passwordmeter.com site some time in the next week or so. Nothing major is planned but I need to revamp it a bit to support the new code base as well as the ability to add new blog entries that are specific to the password meter code. The download link will also be changed so that it points back to the software repository here at Meta Beta Geek. In the mean time, while you’re waiting for the passwordmeter.com site to be updated, you can either play with the demo site, or download the code directly. For downloading, just select the “MBG PWDMeter Package” from the software list. Please let me know if you notice any glaring bugs or issues with the new 2.0 release.

UPDATE:

The scripts and links at passwordmeter.com have now been updated.

Cheers,

Jeff @ Meta Beta Geek

The latest revision of MBG Scaffolder (v2.0.5) has now been pushed to production and for the moment I have no plans for any additional major updates.  So while I’m sorting out licensing issues and preparing the MBG Scaffolder code for public release, I’m reviewing some of my other projects to determine what’s next on my list of priorities.  There are a number of PHP and Javascript pieces in particular that come to mind, but most of these are fairly recent and don’t require a huge amount of changes prior to release.  So I started digging through my code archives to see if any older pieces were due for a review.

One of my earlier works, a piece of code written over two years ago, still manages to generate quite a lot of Internet traffic.  Password Meter is a Javascript project that I literally sat down and wrote in a single weekend.  At that time, it was designed as nothing more than a fun piece of code for users to play with and explore.  I never imagined that it would become as popular a resource as it has, achieving over a thousand hits per day at its current location, www.passwordmeter.com.  The program was designed to rate a user’s password and provide instantaneous visual feedback related to the password’s strength in terms of crackability.

Since the Password Meter code was initially released under general public license (GPL), I have received quite a lot of feedback related to the internal algorithms used to calculate password strength.  I’ve been aware for quite some time now that this portion of the code is in need of a revamp.  I simply haven’t had the time or energy to deal with it.  So the code has remained largely unchanged since its initial release, an issue I hope to remedy in the near future.

In terms of project scope, the Password Meter script itself is not terribly long, so I don’t expect the re-write to take an overly long time.  But I also tend to get rather entrenched in projects like this, so the end result may be quite a bit more complicated than the first release.  For the sake of keeping things simple though, my current plan is to fix the major issues and re-release the code as a new revision. For the time being, even though Meta Beta Geek was intended to track all my coding projects, the source code for Password Meter will remain at its current location.  Any future revisions or modifications to the code will most likely be referenced and tracked here at Meta Beta Geek.

That’s it for updates at the moment.  Stay tuned for a new release of Password Meter very soon, and don’t forget to leave a comment or two if you have suggestions for code or site improvements.  Happy Holidays to you and yours!

UPDATE:

Password Meter version 2.0 is now available for demo or download.

Cheers,

Jeff @ Meta Beta Geek

The MBG Scaffolder package is an open source PHP scaffolding utility designed and modeled (loosely) after the Ruby On Rails scaffolding concept.  Born out of necessity, MBG Scaffolder provided a front-end web interface for quickly manipulating data within MySQL databases.  The first iteration covered the basics, allowing record creation, retrieval, updating and deletion.  It also allowed for automatic table joins using referential rules within the database.  But it was still pretty limited.

About a month ago, MBG Scaffolder underwent a major revamp, gaining a whole lot of additional features in the process.  Effectively reborn, the second iteration of this package exists entirely in a single, mini-fied file of less than 200 kilobytes.  Using MBG Scaffolder is as easy as placing the file in any web-accessible directory and loading the page from a web browser.  The package is written using PHP and Javascript so the web server must have built-in support for PHP (version 5.x or higher) and the client must have Javascript enabled.  Other than that, there are virtually no other dependencies.

For those who are new to the MBG Scaffolder package, consider the following:

Have you ever wanted to join a field containing comma-separated values (record ids) to the records that correspond to those values in a lookup table?  Known as a CSV field type, the option to join lookup tables with comma-separated values is now available, but only using MBG Scaffolder.  Want the ability to control input based on a pre-established list of values from an Enum field type?   New drop list options for all lookup tables, as well as Enum and Set field types are now available, providing users with a friendly list of pre-validated options.  Need to test database performance on a large scale but lack the necessary data?  The new Bulk Insert feature gives developers the ability to insert anywhere from 5 to 10,000 random and data-type specific records in mere seconds.  Tired of filling out the same form field information for dozens of records?  Using the MBG Scaffolder’s Insert Plus One option means you only fill the form out one time for as many records as you need.  Check out the complete list of new features (below) for more details.

In case you missed it, the MBG Scaffolder package also includes built-in help documentation.  I tried to make using the class as intuitive as possible, but I also realize that there may be questions regarding specific features.  If you run into any problems, feel free to leave me feedback using the Comment form, or check for answers within the help docs themselves.  And don’t forget that a good number of the front-end features, such as field labels, buttons, and even some of the more commonly seen errors, offer built-in help links to assist users in getting started.  So if you’re dumbstruck by a particular feature, try looking for a helpful link nearby.

The MBG Scaffolder package is now fully available for download here.  You can also test out a live demo of the most recent version using the credentials that follow.  Tables without a primary or unique key are now fully accessible in a read-only format.  The Blogs and Comments tables are fully modifiable so feel free to add, update and remove records.  The Bulk Insert feature makes it really easy to add records back in for testing.  The remaining tables are locked down since they are the referential tables used to feed the primary tables.  Also, just for the record, I’m not trying to recreate PHPMyAdmin so there are currently no plans for database structure (tables, fields, etc) manipulation at the moment.  This tool is designed strictly with CRUD in mind.

The demo requires the following info:

The server name field supports fully-qualified domain names, so you can conceivably connect up with any DNS-registered MySQL server and play around.  Just be aware that there is no SSL or SSH option yet.  So it works similar to PHPMyAdmin in that respect (credentials are passed unencrypted).  I hope to add an option for SSH some time in the future but this will increase the file footprint dramatically so it’s on hold for now.  Also, the regular expression matching for SQL terms in both queries and records is still in need of tweaking but I’m getting there.  Most everything else should be relatively bug-free.  Please let me know if you come across any issues or have any suggestions for features, etc.