Re: Strong Password Generation

Hi Steve,

Am 30.07.2012 um 23:39 schrieb Stephen R. Smith:
> I've always left password generation as an exercise for the user, and in cases where I've needed to generate passwords and provide them to users I've used 1Password semi-manually.
> 
> I've got a present need to generate relatively strong passwords programmatically, and am curious as to what other people use to do this?
> 
> Is there a Wonder class I'm overlooking that provides this functionality? Do people typically roll their own?

I do my own, because each application is usually tied to some customer who imposes different opionions or restrictions. Plus, it's not hard to do...

For generating safe passwords, I have a static string containing all characters I find eligible to be contained in a password, which basically are all uppercase and lowercase letters, digits and punctuation characters you can find on a keyboard, restricted by the following rules:

- no characters that can be confused with others depending on the font displaying them, like I and l, O and 0

- no umlauts or accents, and no characters that have different places on a keyboard depending on it's layout to be
  German or American. This includes punctuation chars. Reason is: those passwords should be able to get into muscle
  memory, so that you can type them so fast that nobody watching with naked eyes can grasp passwords watching you
  typing them, and having the location of characters change with keyboard layout slows you down typing.

And from that string, I just select random characters and concatenate them to the length required.

Maik



------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/