3

I am looking for a method to generate a onetime password for provisioning purposes in ASP.NET-MVC. I came across the Membership.GeneratePassword which is in the System.Web.Security namespace. Is this a secure way to generate a one time use password?

Improve this question

1 Answer 1

Reset to default
2

Yup, it's fine. Underneath the covers it users the RNGCryptoServiceProvider to generate the password data, which is .NET's wrapper around the CryptoAPI's CSPRNG to generate the data for the password. It's good enough for strongly random key material, so its certainly also good enough for a one-time use password as well.

Improve this answer
3
  • @bdawg Note that while it's a very secure way to generate secure random strings, it's actually a very bad way to generate passwords. You have no control over the character set and you'll end up with passwords like this i.imgur.com/1usU3E8.png that are horrible to handle, give to users, write down, type. The only good time to use it is when you're generating passwords that go into your password manager.
    – Adi
    Mar 15, 2016 at 21:50
  • @bdawg For a better alternative that you can control, have a look at CodesInChaos' answer here stackoverflow.com/a/19068116
    – Adi
    Mar 15, 2016 at 21:52
  • @adi yes I am aware of this. The passwords are unrememberable.
    – bdawg
    Mar 15, 2016 at 22:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .