In an excellent example of how password strength meters make you LESS secure, the Thycotic Secret Server calls a 73 character OAUTH access token "weak" because it only has lowercase letters and hex digits. And I'm supposed to trust this company to protect my secrets?
@clacke @seanl I sort of like the security metric used in apps like KeePass. They basically compress the password and see how small they can make it, and that's the number of bits of entropy. I find it clever, because compression algorithms are designed to strip away everything that's predictable. The better the algorithm, the closer the output bitstream is to only encoding the entropy.
@seanl @clacke Of course, it's not so good with predicting dictionary attacks, unless the symbol table of the compressor is primed with dictionary words first. For all I know, they already do that.