Timeline for What security considerations are there when developing a random password generator?
Current License: CC BY-SA 3.0
15 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 17, 2017 at 14:28 | vote | accept | the_endian | ||
| Mar 15, 2017 at 11:09 | history | tweeted | twitter.com/StackSecurity/status/841969529244774400 | ||
| Mar 15, 2017 at 2:13 | answer | added | Lie Ryan | timeline score: 6 | |
| Mar 14, 2017 at 9:48 | comment | added | user400344 | The password generation itself is trivial, the entropy is not. My passgen (just a perlscript) runs a for-loop up to the specified length, including various charsets, depending on cli options. I do re-seed from random device (although perl does this automatically), but I doubt I have ultrahigh entropy. I've heard of people seeding their PRNG with microphones, accelerometers, seismic sensors, and other fun. | |
| Mar 14, 2017 at 5:23 | answer | added | Xiong Chiamiov | timeline score: 2 | |
| Mar 14, 2017 at 0:40 | comment | added | Zoredache | There are many open source password generators you could get the source for like pwgen, the generator in keypass and so on, which should give you a good starting point | |
| Mar 13, 2017 at 22:10 | comment | added | the_endian | Yes I didn't mean a full scale application, im just talking about a generator here. I did mention it's not a networked application and that I wasn't planning on inventing any new crypto algorithms. I'm simply talking about generating some password strings. In fact, storage or transfer is not part of this at all. | |
| Mar 13, 2017 at 22:08 | comment | added | Arminius | @StephenTouset From my understanding, OP is only interested in the password generation part, not storage, not distribution. An own password manager is obviously a different story. | |
| Mar 13, 2017 at 18:42 | comment | added | Stephen Touset | "Implementing a password creating program… similar to… Symantec and LastPass" is a dramatically larger problem than merely the generation of random passwords. You have to store those passwords, and that needs to be done safely. You need to store metadata — sometimes searchably (and in some cases prior to unlocking the keyring), and that needs to be done safely, too. For a non-toy app, there's browser integration, paste buffer management, and a dozen other things to worry about. This is literally OP's question: "What else of security concern is there?" and the TL;DR answer is "a lot". | |
| Mar 13, 2017 at 18:19 | comment | added | Arminius | I disagree with @StephenTouset that this is the "textbook definition" of rolling your own crypto. Random password generation can't be compared to inventing your own hashing algorithm. | |
| Mar 13, 2017 at 18:07 | comment | added | the_endian | Ok, well, that makes sense. Apologize if I was a little short-sighted in that regard as this Q will likely be viewed but many people in the future. Anyways, definitely don't worry about me, I'm a malware researcher and won't be releasing insecure products anytime soon :) | |
| Mar 13, 2017 at 18:04 | comment | added | Stephen Touset | This is just a standard disclaimer — only so much fits into a comment. Many, many people come here to get basic crypto questions answered in order to build something that they intend to release to the public, without understanding that there are as many traps involved in designing and implementing a system as there are in building cryptographic primitives. | |
| Mar 13, 2017 at 18:01 | comment | added | the_endian | Did I say I'd be releasing it? And resources to where I can "get more qualified" would be great because right now your comment is a little cryptic. Should I study more cryptography? Networking? Etc... there's not much value offered in terms of real world advice here other than just "don't do it" which isn't really advice honestly. | |
| Mar 13, 2017 at 17:57 | comment | added | Stephen Touset | This is pretty much the textbook definition of rolling your own crypto[system]. As Thomas Ptacek put it, if you go into it thinking that the dangerous stuff is in the primitives like the AES core, and if you just stick to the glue you'll be safe, you're gonna have a bad time. If you have to ask this question, you are not qualified to be distributing this kind of software. So by all means, please build to your heart's content for the sake of learning. But please don't release this software or otherwise distribute it to others. | |
| Mar 13, 2017 at 17:29 | history | asked | the_endian | CC BY-SA 3.0 |