Re: inetd questions

["David Zoll" <dzoll@nyscul.org>]

Damian Menscher wrote:
> 
> On Mon, 11 Dec 2000, Ethan Benson wrote:
> 
> > tell what is so damn insecure about these?
> >
> > $ while true ; do makepasswd --chars=12 ; done
> > t2nWXiWynAU8
> > qdesULEdwzLG
> > g3YfAxqxLG1d
> 
> Well, since you asked.... there is no punctuation.

Is there anything wrong with this then?
   $ pwgen -s 8 10
   u/F6@rcH
   /6eXDy`u
   4v0iU&g>
   >M%]w16[
   Zkx]fu{d
   w-r^T[cm
   7Lk^BAKv
   gVljY_Lk
   %ufkHE5t
   D7_k6+z}
For root/privileged users, and:
   $ pwgen -n -c 8 10
   edioo2Th
   au6Doov
   iquo7Vo
   aquoo3Ch
   ngoothi
   thange3V
   ti4Ubeph
   tho4Kaoo
   poooo7S
   jo9Peey
For unprivileged users?

IMHO, "aquoo3Ch" is more secure than ">M%]w16[" when given to your
typical end user, since you can actually successfully demand the user
remember the first, while if given the second they'll sneak it onto a
post-it as soon as you're not looking.


> Ideally, I would like to see control characters in passwords.  Anyone know of a complete
> list of which are acceptable/unacceptable?

Don't know, but if you log in from arbitrary machines, you have the
additional complication of possible terminal munging/incompatibilities
making it impossible for you to log on.  I avoid using them, they're not
necessary.

-Gleef