3 ms·
> what's the best way to generate "safe" license keys? In the library (like the kind with books) field where I work, one identifier standard was devised that i
by jrochkind1 4y ago
> what's the best way to generate "safe" license keys?
In the library (like the kind with books) field where I work, one identifier standard was devised that intentionally has alternating letters and digits, with never more than two letters in a row. Explicitly for the intention of avoiding the possibility of any meaningful words (that might end up being offensive or just off-putting in an undesirable way.)
It does make the identifiers longer for the same entropy/byte width, compared to a more normal BASE-X with an alphabet. Which mattered to me when they were going to be used in a URL, although probably doesn't for a license key. I personally in my projects stopped using this system for a more straightforward "Ascii-85" like encoding (which can contain coincidental meaningful words), because it was more convenient.
The particular system the library community was using [https://n2t.net/e/noid.html https://n2t.net/e/noid.html] was, I still think, over-complicated for at least my needs, but the alternating letter/number schema seems attractive to me now and perhaps worth slightly more characters in identifiers and slightly more complex algorithm for creation than a simple base-x encoding.
- cromulent 4y agoIt sounds good, but of course for "security" it might not be enough. 626f6d62 is alternating letters and digits, with never more than two letters in a row. And it spells "bomb" when converted from hex to ascii. Some security scanners do check for this kind of thing.
- jrochkind1 4y agoWhy would you convert an identifier to ascii as if it were hex? And it seems unlikely that (eg) paypal would do so? But, sure, it's just one idea. You can add more layers to make it even less likely something will seem problematic to someone somewhere; a 100% guarantee seems impossible, especially if you are going to allow things like above "What if we brainstorm for a way this could be a puzzle where the answer is a problematic word to someone". No "scanner" will even possibly catch every possible thing in that domain, no matter how unlikely.
- GoblinSlayer 4y agoStore it as a brainfuck program that generates the required string.
- crazygringo 4y agoFor the user to type in as a license key? That's a special kind of evil...