3

Here's a scenario that I often encounter:

  1. Some user needs access to something on my network, but they don't have an existing account in AD.
  2. I create an AD account for them which I then use to allow access to an SSL VPN or an SFTP account or whatever.

I typically send an email with detailed connection instructions and text them a password. I often use a free service provided by Norton to generate a random password with >= 8 chars.

Without knowing what algorithm Norton uses to generate these random char strings, the question is, is this secure? The site I'm using to generate the passwords is SSL and I'm texting the password to the user, thereby separating the instructions (via email) from the required password.

How could I approach this problem differently in order to make the process more secure without having the ability to have the end user set their own password?

  • don't text the passwords. i used to get a log of sent TXTs with my bill... As far as the password generation goes, i'm sure it's fine and way better than a human would do. – dandavis Jun 2 '16 at 18:51
  • i didn't notice that the password generator was online and i don't like that. there's plenty of ways to generate something locally and most of them are pretty good these days. – dandavis Jun 3 '16 at 0:38
  • "without having the ability to have the end user set their own password" Why do you exclude that as a possibility? If the password must be changed on the first use, many of the problems of transmitting passwords in cleartext are reduced. (Not to say they don't apply.) – a CVn Jun 3 '16 at 12:34
  • My current infrastructure/software doesn't allow me to force a password change and, even if it did, I still need to get the user a temporary one in some fashion, right? – Tedwin Jun 5 '16 at 4:17
2

You might consider the random.org password generator which uses randomness based on atmospheric noise. Another option is Hotbits which gets its random data from radioactive decays.

For sharing passwords, you might want to use a self-destructing message site such as cloakmy.org or privnote.com that let you create secure password-encrypted messages that self destruct after viewing once or after a set time period.

Yet another option is to use something like LastPass that both generates secure passwords and provides a way to share that password with others.

  • +1 for self-destructing messages. Way better than phone texts. – Potaito Jun 2 '16 at 21:01
  • 2
    Self destructing message is a myth. You are relying on the service provider to not log the messages. For all we know these self destructing messaging system could be honey pots set up to collect passwords. – Lie Ryan Jun 2 '16 at 23:26
  • 2
    @LieRyan This depends on the service provider of course and how they do encryption. Cloakmy.org uses javascript to encrypt the message in the browser so the plaintext is never sent to the server. – Mark Burnett Jun 3 '16 at 23:51
-1

It's secure, but as a user, it doesn't substitute a password that I choose. For example, if you configure the generator to generate the passwords with 10 characteres, 2 of them as symbols, 5 letters (mixed between upper and lowercase) and 3 numbers, like this: 4&Ab9@DL7f of course it's a strong password, but it's kind impossible to record.

So, responding to your question, yes, it's secure, but you have to configure it to be secure.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.