Password generator and password limitations

Question

I would like suggestions for a good strategy for dealing with web sites that have arcane rules about what must or must not appear in a password.

My ideal are the sites that allow a good range of characters, a relatively long password length, and no special rules. In those cases, my password is chosen by a password generator from e.g. 68²⁰ equally probable possibilities. Nice and easy.

Even if there are rules, with a reasonably long length, I can often get an acceptable password by spinning the generator a few times.

The worst case are short passwords with rules like at least one character from each of two or three classes. My current strategy is to edit a generated password making as few changes as possible to make it acceptable. I don't like this, because it depends on my own ability to make random choices, which is not good.

Is there a better strategy, or even a known best strategy?

Answer 1

The best known strategy for generating a password is to generate it randomly. The goal is for it to be as unique as possible, so that it's unlikely to be found in a password dictionary, which is often populated with passwords from previous breaches.

This doesn't change when the site has poor password requirements.

Many password managers will let you specify the types of characters that are allowed and required, as well as the password length. If you can't get your generated password to match the site's requirements, it's okay to edit the password by hand.

If you're feeling generous, and would like to help the other users of the site, you can go a step further and complain to customer service over the password requirements, citing best practices and standards, such as the NIST Authentication Guidelines.

When I complain to customer service, and if I don't care for a response, but would want to make sure their customer service department forwards the complaint to their developers -- or I see evidence that passwords are being handled in an absurdly unsafe way like being stored as plaintext -- I rudely question the intelligence of their developers, managers, and company officers while making certain that the best practices are well cited, such as pointing out the specific section and paragraph...

I.e., saying something along the lines of "the first paragraph of Section 5.1.1.2 of NIST Special Publication 800-63b sets 8 character passwords as the absolute minimum, and very strongly recommends going up to 64 characters or more. Only an idiot tells their employees to do the absolute minimum for security, and any developer who graduated grade school would know that the only technical reason to restrict password length is that bcrypt can't handle passwords longer than 72 bytes long! After all, every password is stored as an unrecoverable hash, so input length doesn't affect output length, right? RIGHT???"

I don't get responses when I send emails like that, but I do see that the password requirements change within weeks of sending those emails, so...

Answer 2

Worst case: generate your random password, then add a few characters to meet the complexity requirements. Adding characters cannot decrease security.

Alternate idea: try a different, more configurable generator. KeePass, for example, while mostly a PW manager, also contains a highly configurable password generator. You can specify exact sets of characters to include, among many other options.

Answer 3

You can use urandom in combination with tr and head to generate random passwords. With a a few small tweaks, you can adjust the length of the generated password and include/exclude specific types of characters to satisfy just about any site's requirements.

For example, to create a password 16 characters long containing just uppercase and lowercase letters:

head /dev/urandom | tr -dc '[:alpha:]' | cut -c 1-16

To create a password 12 characters long containing just uppercase and lowercase letters and digits:

head /dev/urandom | tr -dc '[:alpha:][:digit:]' | cut -c 1-12

To create a password 20 characters long containing uppercase and lowercase letters, digits, and symbols:

head /dev/urandom | tr -dc '[:alpha:][:digit:][:graph:]' | cut -c 1-20