Re:Passwords, Backups and a false sense of security
by parfe on Saturday August 04, 2012 @02:00PM
(#4339121)
# apt-get install pwgen
$ pwgen -1
enieQu3C
$ pwgen -1y
fa]m\e8O
$ pwgen -1sy 12
D[=,*j=65%
pwgen by default outputs a screenful of possible passwords. This is useful if two people are looking at the screen. -1 flag limits the output to a single password.
Re:Passwords, Backups and a false sense of security
by peterwwillis on Saturday August 04, 2012 @02:32PM
(#4339223)
For a secure password, you might want to use something with a better random seed: http://cpansearch.perl.org/src/GARY/Math-TrulyRandom-1.0/exa...
Re:Passwords, Backups and a false sense of security
by DavidSJ on Saturday August 04, 2012 @01:40PM
(#4339072)
rand() is not cryptographically secure. You should not rely on it in security-sensitive situations.
Re:Passwords, Backups and a false sense of security
by larrys on Saturday August 04, 2012 @01:48PM
(#4339095)
Agree but as I said it also "only generates 7 digits with no UC" which is even worse. My point is simply that you can do this by the command line. And depending on what the purpose of the password is (and how difficult you want it to be) in many cases it fits the purpose.
If I was generating initial passwords for someone's email account for example I probably would also leave out digits and letters that are easily confused, like 0 and O and l and 1 and some other things which isn't a best practice either but might be appropriate for other reasons.
Re:Passwords, Backups and a false sense of security
by rane on Saturday August 04, 2012 @03:11PM
(#4339336)
Can you give a practical example how this can become a problem if I use rand() to generate a password to be used on a website?
Re:Passwords, Backups and a false sense of security
by barrkel on Saturday August 04, 2012 @06:34PM
(#4339904)
Many PRNGs only have 32 bits of state. If someone knows your settings (alphabet chosen and length) the max number of passwords to check is 4 billion.
Re:Passwords, Backups and a false sense of security
by kngl on Saturday August 04, 2012 @02:08PM
(#4339150)
or use apg: http://www.adel.nursat.kz/apg/ (installable via apt/yum/brew)
perl -le'print map { (a..z,a..z,0..9,"\$","!","-")[rand 65] } 0..pop' 7
Note this particular one only generates 7 digits with no UC. You can alter it to your taste or needs.
You can also wrap it in a shell script to generate a bunch in a row (in this case 10), like this:
for i in {1..10}
do
perl -le'print map { (a..z,a..z,0..9,"\$","!","-")[rand 65] } 0..pop' 20
done
As an aside I don't like any web based site that generates passwords (nor do you need that as just shown) since there is no way to know if the passwords generated are being logged along with some identifying information.