Damian Menscher wrote:
>
> On Mon, 11 Dec 2000, Ethan Benson wrote:
>
> > tell what is so damn insecure about these?
> >
> > $ while true ; do makepasswd --chars=12 ; done
> > t2nWXiWynAU8
> > qdesULEdwzLG
> > g3YfAxqxLG1d
>
> Well, since you asked.... there is no punctuation.
Is there anything wrong with this then?
$ pwgen -s 8 10
u/[EMAIL PROTECTED]
/6eXDy`u
4v0iU&g>
>M%]w16[
Zkx]fu{d
w-r^T[cm
7Lk^BAKv
gVljY_Lk
%ufkHE5t
D7_k6+z}
For root/privileged users, and:
$ pwgen -n -c 8 10
edioo2Th
au6Doov
iquo7Vo
aquoo3Ch
ngoothi
thange3V
ti4Ubeph
tho4Kaoo
poooo7S
jo9Peey
For unprivileged users?
IMHO, "aquoo3Ch" is more secure than ">M%]w16[" when given to your
typical end user, since you can actually successfully demand the user
remember the first, while if given the second they'll sneak it onto a
post-it as soon as you're not looking.
> Ideally, I would like to see control characters in passwords. Anyone know of
> a complete
> list of which are acceptable/unacceptable?
Don't know, but if you log in from arbitrary machines, you have the
additional complication of possible terminal munging/incompatibilities
making it impossible for you to log on. I avoid using them, they're not
necessary.
-Gleef
