Beefy Boxes and Bandwidth Generously Provided by pair Networks
more useful options
 
PerlMonks  

Words without a Dictionary

by Anonymous Monk
on Jul 22, 2003 at 18:31 UTC ( #276864=perlquestion: print w/replies, xml ) Need Help??

Anonymous Monk has asked for the wisdom of the Perl Monks concerning the following question:

Hi All,

Now, this is a bit of a strange one, but i don't think it should be *too* complex.

I have a script that currently generates random passwords based on upper/lower case characters and number.
Most of my users cant even type these passwords in, let alone remember them for more than 10 seconds, so i was wondering if there is a way to generate a random word (without having a ton of words listed in a file or something).
If there is not a way to do this, the other way that i was thinking about was to generate meaningless words by patching random characters and part words together, so a randomly generated word might be:

*letters in upper case are random*
G a F ing
B e Z er
F i Z and
S o Q ups

Help would be much appreciated.

Replies are listed 'Best First'.
Re: Words without a Dictionary
by sauoq (Abbot) on Jul 22, 2003 at 18:36 UTC
      Hi, can you show me how i would use Crypt::GeneratePassword? Also, if it is a module that needs to be installed, then my ISP will not allow me to do this :(

        can you show me how i would use Crypt::GeneratePassword?

        See the documentation on CPAN for examples.

        Also, if it is a module that needs to be installed, then my ISP will not allow me to do this

        The module appears to be pure Perl, so you can simply copy the .pm files to your script or library directory, or you can include the text of the .pm files into your scripts as long as you preserve the "package" declarations.

Re: Words without a Dictionary
by dbwiz (Curate) on Jul 22, 2003 at 19:40 UTC

    An alternative way of generating non dictionary passwords is to use letters from a given phrase that the user can remember.

    A trivial example. Given the phrase Any sufficiently advanced technology is indistinguishable from magic (Arthur C. Clarke) you can make a password "Asatiifm," which is easy to remember, once you know the catchphrase. You can make the method a little bit more complicated, by instructing users to use the last letter from every odd word, and the number of letters for every even one. So the password could be "y12d10s17m5," again easy to remember from the above schema.

    Don't expect the users to learn these kind of passwords on the spot, though. Some training is needed, but after a few lessons, they should be able to cope with the problem without forgetting the password and without being tempted to write it down.

    Or you can borrow the idea in this article and implement some more complicated mechanism. More security, but more training needed. Your call.

      I used to teach users this technique all the time. What I'd suggest is a familiar song lyric. This way the words will usually come out right and probably won't be forgotten. I suppose if you forgot the words, you could always look them up as well.

      Of course, there is the danger of misheard lyrics.

Re: Words without a Dictionary
by halley (Prior) on Jul 22, 2003 at 19:02 UTC

    Most of my users cant even type these passwords in, let alone remember them for more than 10 seconds...

    A user really should not need to remember a password that YOU or your SYSTEM generated. They just need to be able to type it once, and then define a password for THEMSELVES. Two benefits: (1) you have less liability if you don't know their passwords, and (2) they can design passwords that they can remember.

    Security and Convenience are typically opposed. The easier, the weaker. The stronger, the more complicated. The challenge is not in developing secure rules, but in encouraging secure behavior. Make the rules too strict and the users will break them (password on PostIt). Make the rules too lax and the users will drive right through them (password eq userid). Help them understand the implications of security and liability, and how to choose strong yet mnemonic passwords on their own.

    Update: Yes, I implied but didn't stipulate that the best practice is to generate a use-once password and force a password change.

    --
    [ e d @ h a l l e y . c c ]

      Two benefits: (1) you have less liability if you don't know their passwords, and (2) they can design passwords that they can remember.

      And one drawback: some people are likely to write it down rather than change it. If you can force them to change it, that's great. But if not, there is some merit to generating pronounceable passwords.

      BTW, your reason (1) doesn't necessarily apply at all. Generating a password for a user doesn't imply keeping a record of it.

      -sauoq
      "My two cents aren't worth a dime.";
      
      define a password for THEMSELVES. Two benefits

      One very serious drawback: ten percent of your users' passwords will be brute-forceable given fifty tries.

      If you are an ISP, this may be okay. Warn the users that if anyone guesses their password they're fully responsible, don't give them access to anything but their own stuff, patch against whatever local root exploits are discovered, and that'll probably do.

      If your users have to have access to stuff that you have to protect, then you have problems. If possible, the mechanism users use to change their passwords should check against a list of common passwords and a dictionary and reject any password that's very close to anything on the list or in the dictionary.

      Of course, if you can give them a secure password that they can remember... There was an article on slashdot recently about using inkblots as password clues, but what about using pronounceable sequences or words?

      I did a little arithmetic on this issue, and I have concluded that a sufficient number of dictionary words (at least three IIRC, but it of course depends on the size of your dictionary) strung together with hyphens can be as secure as a much harder-to-remember random password. It takes longer to type the words, but they are easier to remember. There's your tradeoff. Say your dictionary has twenty thousand words and you use $n of them, that's (20000)**$n possibilities. The traditional approach (using sequences of random characters from [A-Za-z0-9]) gets more like (62)**$n and so requires a somewhat higher n. Thus, you don't have to string eight words together to surpass the security of an eight-character random password. Three words may be adequate for some purposes (especially if you use a large dictionary) -- and it will be easier to remember. Even a four-word password (so your dictionary only needs to have 64*64 words in it) may be easier to remember than jEp3WkbG, if you consider a word to be easier to recall than two random characters.


      $;=sub{$/};@;=map{my($a,$b)=($_,$;);$;=sub{$a.$b->()}} split//,".rekcah lreP rehtona tsuJ";$\=$ ;->();print$/
Re: Words without a Dictionary
by simonm (Vicar) on Jul 22, 2003 at 18:37 UTC
    If the intent is to make the passwords easier for users to remember, one trick is to alternate random consonants with random vowels, so they form an "almost word". However, even if you switch cases, and throw in some punctuation, this reduces the security of your password system by making it easier to brute-force search.
      Hi simonm, would you be able to show me how to do this? I am fairly new to perl and still learning the ropes. I wouldn't worry too much about it being hacked, as each user is responsible for changing their own password after the random one has been assigned, no users have any important data stored, keeping the easy password is 'at their own risk', and there would be no compramise to the main system even if an account was attacked (the important accounts all have 16 character long passwords with symbols).

        would you be able to show me how to do this?

        By the standards of the Perl Monks, it would be better for you to start by posting your current "totally random" code, and making at least a partial attempt to make the change, instead of just asking someone else to write your code for you.

        Nonetheless, here's some working example code. You could easily extend this to make the words longer, or add a list of punctuation characters to mix in, or randomly switch around between a few different patterns of words, like "CVCVC", "VCVCC", and "CVVCV".

        # Build arrays of vowels and consonants my @vowels = qw( a e i o u y ); my %vowels = map { $_ => 1 } @vowels; my @consns = grep { ! $vowels{$_} } ( 'a' .. 'z' ); # Also include uppercase letters push @vowels, map uc, @vowels; push @consns, map uc, @consns; # subroutine to pick a random entry from an array sub pick_one { my $array_ref = shift; return $array_ref->[ int rand( @$array_ref ) ]; } # Define a pattern of "CVCVC" my @syntax = ( \@consns, \@vowels, \@consns, \@vowels, \@consns ); # Do this part each time you need a new password foreach ( 1 .. 10 ) { # Generate a random psuedo-word my $word = join '', map { pick_one( $_ ) } @syntax; # Then do something with it... print "$word\n"; }
Re: Words without a Dictionary
by dragonchild (Archbishop) on Jul 22, 2003 at 18:56 UTC
    { my @words = qw( perl monk vroom ); my %convert = ( i => '!', e => '#', s => '%', o => ')', ); sub generate_password { my $word = $words[rand @words] . $words[rand @words]; $word =~ s/(.)/$convert{$1} || $1/eg; $word; } }
    That's actually the algorithm I use for my passwords at work (with different words). I then remember my passwords by having a sticky in my cube with a list of words, then "34" (or the like) to reference into that list, but with the appropriate numifying and shifting.

    Is it secure? Depeneds on how secure you need to be. It wouldn't pass a strict security audit, but, then again, no-one's ever broken into an account of mine in over 4 years ...

    ------
    We are the carpenters and bricklayers of the Information Age.

    Don't go borrowing trouble. For programmers, this means Worry only about what you need to implement.

    Please remember that I'm crufty and crochety. All opinions are purely mine and all code is untested, unless otherwise specified.

      no-one's ever broken into an account of mine in over 4 years ...

      Uh... at least, not that you know of... huh? ;-)

      -sauoq
      "My two cents aren't worth a dime.";
      
      Thanks dragonchild, but excuse me for being thick, but what is the generated word output to? i tried printing $word, but that always comes out blank??
        You are being thick. $word is a variable that's scoped to the generate_password() subroutine. Of course, you can't print it out. Try printing the value returned by calling the subroutine, as seen below:
        #!/usr/bin/perl { my @words = qw( perl monk vroom ); my %convert = ( i => '!', e => '#', s => '%', o => ')', ); sub generate_password { my $word = $words[rand @words] . $words[rand @words]; $word =~ s/(.)/$convert{$1} || $1/eg; $word; } } print generate_password(), $/;

        ------
        We are the carpenters and bricklayers of the Information Age.

        Don't go borrowing trouble. For programmers, this means Worry only about what you need to implement.

        Please remember that I'm crufty and crochety. All opinions are purely mine and all code is untested, unless otherwise specified.

Log In?
Username:
Password:

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: perlquestion [id://276864]
Approved by sauoq
Front-paged by broquaint
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others rifling through the Monastery: (4)
As of 2021-12-01 22:52 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?
    R or B?



    Results (15 votes). Check out past polls.

    Notices?