Writing a Simple Password Generator in Racket

Re:Writing a Simple Password Generator in Racket by bjoli on Friday March 08, 2019 @04:13AM (#19336156)

I have been thinking about that. How would one do that with a minimal impact on password security? Character sets are easy, but one could set some arbitrary limits on character frequency. I would probably generate a shitload of passwords and filter them based on the rules since that would mean not having to have complicated logic for password generation and thus not accidentally generating passwords that are less secure than the rule limitations.

[ Parent | on HN ]

Re:Writing a Simple Password Generator in Racket by rkangel on Friday March 08, 2019 @09:12AM (#19337583)

I still think that the best approach to password requirements was the one used at Nortel. They ran a password hash cracking algorithm continuously on the PW database, and when they cracked yours you had to change it. Other than that there were no complexity requirements or mandatory change intervals. If you had a good complex password you got to keep it for a long time, and if you set '12345', 1 minute later you'd have to change it.

[ Parent | on HN ]

Re:Writing a Simple Password Generator in Racket by brumm on Friday March 08, 2019 @09:46AM (#19337864)

That is super cool. Is there any reading material on this somewhere?

[ Parent | on HN ]

Re:Writing a Simple Password Generator in Racket by rkangel on Friday March 08, 2019 @11:09AM (#19338774)

I heard this anecdotally from a long time colleague of mine who worked there. I don't know of any more solid reference to give, sorry.

[ Parent | on HN ]

Re:Writing a Simple Password Generator in Racket by bjoli on Friday March 08, 2019 @06:31AM (#19336668)

I made this: https://pastebin.com/kQhKexEd in 5 minutes. It is however slightly off with the random distribution since I am only doing a simple remainder.

[ Parent | on HN ]

Re:Writing a Simple Password Generator in Racket by andreareina on Friday March 08, 2019 @07:44AM (#19337022)

    (let ((byte (remainder (get-u8 urandom) size)))

is skewed if size isn't a power of 2. What you should do is mod by the next-largest power of 2 (e.g. if size is 82, mod by 128). Then if the result is in-range use it, otherwise discard and reroll.

[ Parent | on HN ]

Re:Writing a Simple Password Generator in Racket by bjoli on Friday March 08, 2019 @07:48AM (#19337044)

I just edited the comment before I saw your answer. I realised my mistake and wanted to sink through the earth. Everyone has brain farts, I guess.

What I ended up doing was limiting the charset size to 256 a maximum of characters, and then discarding any value that is larger than the current charset.

[ Parent | on HN ]