Re: Password protection

I like the concept but your requirement to NOT store the Password Of the 
Day and generate it every time it's needed means you can't pick other 
external inputs to feed the process. For example you could call a web 
service to check the temperature in some known location as one bit of 
the seed, then check the water level in some river, toss in the cycle of 
the moon, and the date, mix in the percent full of the disks, and add a 
pinch of the faulting rate for the *BASE pool. Oh but all of those 
things change constantly except the date, rats.  Maybe you could 
architect it so the P.O.D. is kept in a running program only and 
requested from that program. Each time the program starts or when some 
magic time each day occurs it generates the P.O.D and holds it. Just a 
thought.....

  - DrFranken

On 6/11/2010 6:05 PM, Simon Coulter wrote:
>
> Looking for suggestions:
>
> I want to protect access to an application via a password. I want the
> password to automatically change daily. I want the application to be
> able to determine today's password without having to read it from an
> external source (i.e., algorithmically/programmatically derived). This
> last requirement means:
>
> 	o no special profile with password changed daily
> 	o no validation list use
> 	o no encrypted password stored in external object such as *FILE or
> *DTAARA
>
> I envisage:
> 	o Application objects are *PUBLIC *EXCLUDE
> 	o Application objects are authorised to a specific group profile
> 	o Password generator is *PUBLIC *EXCLUDE
> 	o Password generator is authorised to a specific profile (different
> from the above)
>
> In actual use a user who is a member of the application group AND who
> needs to use this particular application will request the password
> from an authorised issuer. The issuer will use the password generator
> to determine today's password. The user will then use the application.
>
> The "automatic daily change" requirement means the password generation/
> validation is tied to the date but obviously simple encryption linked
> to the date will not be very secure nor will each daily password be
> sufficiently different from the previous one.
>
> I have some ideas but thought I would see what others suggest--always
> presuming you think this sufficiently interesting to bother with :)
>
> Regards,
> Simon Coulter.
> --------------------------------------------------------------------
>      FlyByNight Software         OS/400, i5/OS Technical Specialists
>
>      http://www.flybynight.com.au/
>      Phone: +61 2 6657 8251   Mobile: +61 0411 091 400        /"\
>      Fax:   +61 2 6657 8251                                   \ /
>                                                                X
>                    ASCII Ribbon campaign against HTML E-Mail  / \
> --------------------------------------------------------------------
>
>
>
> _______________________________________________
> This is the Security Administration on the AS400 / iSeries (Security400) mailing list
> To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/security400
> or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/security400.
>
>    

_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.