3 ms·
I have been thinking about that. How would one do that with a minimal impact on password security? Character sets are easy, but one could set some arbitrary lim
by bjoli 8y ago
I have been thinking about that. How would one do that with a minimal impact on password security? Character sets are easy, but one could set some arbitrary limits on character frequency. I would probably generate a shitload of passwords and filter them based on the rules since that would mean not having to have complicated logic for password generation and thus not accidentally generating passwords that are less secure than the rule limitations.
- bjoli 8y agoI made this: https://pastebin.com/kQhKexEd https://pastebin.com/kQhKexEd in 5 minutes. It is however slightly off with the random distribution since I am only doing a simple remainder.
- andreareina 8y ago(let ((byte (remainder (get-u8 urandom) size))) is skewed if size isn't a power of 2. What you should do is mod by the next-largest power of 2 (e.g. if size is 82, mod by 128). Then if the result is in-range use it, otherwise discard and reroll.
- bjoli 8y agoI just edited the comment before I saw your answer. I realised my mistake and wanted to sink through the earth. Everyone has brain farts, I guess. What I ended up doing was limiting the charset size to 256 a maximum of characters, and then discarding any value that is larger than the current charset.
- rkangel 8y agoI still think that the best approach to password requirements was the one used at Nortel. They ran a password hash cracking algorithm continuously on the PW database, and when they cracked yours you had to change it. Other than that there were no complexity requirements or mandatory change intervals. If you had a good complex password you got to keep it for a long time, and if you set '12345', 1 minute later you'd have to change it.