Post · bonfire.cafe

Post

I'm looking for a simple (standalone, offline, portabel) password generator.

The idea is to "give" it to users when they are requested to change their password
(Reasoning: The time you are forced to change your password NOW is the worst time to think of a unique strong password)

Ideally the generated password should be memorable and typable (on mobile)

It might be a good idea to offer choices and a regenerate option.
Choices might be #DiceWare passwords (with a language specific wordlist)

Ideally the passwords should confirm to configurable password policies

And it should be necessary to mention it. It should be secure!

Edit: a way to add the the password proposals to the Windows password change dialog would also be nice (i belive Ubuntu día something like this)

#Boost and recommendations welcome

amy

@amy@fedi.amy.mov replied · 2 weeks ago

@realn2s@infosec.exchange i’m curious how you would force a change but also allow access to this tool on the company device

at least for a windows domain you have to do all of this on the lock screen..?

Claudius Link

@realn2s@infosec.exchange replied · 2 weeks ago

A bit more details

Imagine you identified users who have a weak password, reused their password, or use a password from known breaches.

I would like to notify them that they need to change their password and at the same time increase that chance that they pick a good password when they are asked (or forced) to change their password.

As the password is for their central account a password safe is of limited use 😬
As they can't access their company system without the password, they would need a password safe on another (non-company) device

#cybersecurity #fedipower

Claudius Link

@realn2s@infosec.exchange replied · last week

Here some resources on secure and usable passwords:

Lorrie Cranor's work at https://lorrie.cranor.org/ , the CyLab Usable Privacy and Security Laboratory (CUPS) https://cups.cs.cmu.edu/ and her #TedTalk https://www.ted.com/talks/lorrie_faith_cranor_what_s_wrong_with_your_pa_w0rd

I will add more resources over time

Brahms

@brahms@chaos.social replied · 2 weeks ago

@realn2s I mean the obvious answer would be pivoting to passkeys and passwordless auth?

is there any reason why thats not applicable here?

d@nny disc@ mc²

@hipsterelectron@circumstances.run replied · 2 weeks ago

@realn2s this is a really good and thoughtful idea

d@nny disc@ mc²

@hipsterelectron@circumstances.run replied · 2 weeks ago

@realn2s i literally use a script in emacs lisp for this purpose

blackopelves

@blackopelves@infosec.exchange replied · 2 weeks ago

@realn2s oh, and once you have used this tool the password doesn't age out anymore.

blackopelves

@blackopelves@infosec.exchange replied · 2 weeks ago

@realn2s we created an internal web-based tool that combines the zxcvbn lib, the hibp password compromise check, the AD policy an internal self maintained blocklist and some compliance theater boxes into an interactive password check & change tool. Especially zxcvbn helps...

Claudius Link

@realn2s@infosec.exchange replied · 2 weeks ago

@blackopelves
That is a very good pointer, thanks 🙏🏻

Orlando Gentil

@OG@bolha.us replied · 2 weeks ago

@realn2s if one is taking the time to install a password generator, they could take the opportunity to introduce a password manager like https://keepassxc.org (as per the requirements you asked). It might be challenging to remember randomly generated passwords.