Page MenuHomePhabricator

Add password generator to account creation / password change form
Open, Needs TriagePublic

Description

It would be nice to have a "generate me a strong password" button with localizable requirements.

Event Timeline

Tgr created this task.Nov 18 2016, 1:02 AM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptNov 18 2016, 1:02 AM
Stryn added a subscriber: Stryn.Dec 6 2018, 10:34 PM
Tgr added a comment.Dec 9 2018, 9:23 PM

There are two types of good password generation:

  1. A medium-length string of random uppercase/lowercase/numbers (say 12 or 16 characters), with easily confusable characters removed from the pool.
  2. A long human-readable text of space-separated random dictionary words (probably 5 or 6 words), e.g. diceware.

I'm not sure the first is worth doing as the only sane way to use such passwords is a password manager and that can generate random passwords just fine. (Maybe there are less technical users who have problems with password managers and just write the passwords down, but those are better served by diceware style passwords anyway since words are easier to type.) OTOH it is very trivial to implement.

The second is good for people who need to memorize the password for some reason, or need to type it in often (ie. often log in on foreign machines). The best library I have seen for it is grempe/diceware (test page), which has support for ~20 languages (of course it would be fairly trivial to add more). Word lists are around 100K which is a bit large but they don't exactly make an effort to reduce the size, which could be done pretty easily.

I'm not sure how worthwhile this would be if we ever got a decent password strength meter deployed. Though digging through the history, that might be a big if.

There are two types of good password generation:

  1. A medium-length string of random uppercase/lowercase/numbers (say 12 or 16 characters), with easily confusable characters removed from the pool.
  2. A long human-readable text of space-separated random dictionary words (probably 5 or 6 words), e.g. diceware.

I'm not sure the first is worth doing as the only sane way to use such passwords is a password manager and that can generate random passwords just fine. (Maybe there are less technical users who have problems with password managers and just write the passwords down, but those are better served by diceware style passwords anyway since words are easier to type.) OTOH it is very trivial to implement.
The second is good for people who need to memorize the password for some reason, or need to type it in often (ie. often log in on foreign machines). The best library I have seen for it is grempe/diceware (test page), which has support for ~20 languages (of course it would be fairly trivial to add more). Word lists are around 100K which is a bit large but they don't exactly make an effort to reduce the size, which could be done pretty easily.

My feeling about this is adding password generation into the authentication flow is a pretty new concept and while there may be some security benefit there are a lot of unknowns here and some potential abuse. Maybe a compromise is the addition of a link to security awareness content during the account creation/passwd change flow and the inclusion of a strength meter?

Tgr added a comment.May 9 2019, 6:09 PM

Google Chrome includes a password generator (and manager) these days that they prompt a user to use any time a password field with no saved passwords is focused: