Dean,

The following note is about the philosophy rather than the practice of
password generation. Anyone not interested is invited to move on to the
next message.

Password generators aren't as popular as they once were, due to the
difficulty of remembering and typing a truly random sequence of characters.
Digital Equipment (and now you know my provenance) tried them on VMS about
ten years ago, but pretty much gave them up, first in favor of a dictionary
lookup (which in retrospect had obvious problems - "aluminum" was not
valid, but "aluminium" (British spelling) was fine), later in favor of a
user-specified policy module, typically one that requires digits and/or
punctuation. Digital is no more, but Compaq (or is it Hewlett-Packard?)
still supports this.

Digital tried to alleviate the "unmemorableness" problem of random
passwords by some process that generated random phonemes rather than random
strings (I still remember "pigrathope" fondly). They also would give you a
selection of passwords, allowing you to pick the one you could remember the
easiest (and, by the way, screen out any accidentally-generated English
words).

But there was another problem with generated passwords, that transpired
when a Digital employee showed up at a users' group meeting with what he
called "The Official Digital Dirty Word List." If any of the combinations
of letters on the list appeared in one of the random passwords, that
password was never presented to the user - another one was generated
instead. The list occupied two columns of an 8.5 x 11 (approximately A4),
and was clearly multilingual. Everyone present was immediately pressed into
service identifying the words by language, and generating a full English
translation. I don't remember the complete partitioning, but if number of
words in a given language was any indication, English-speakers are fairly
sensitive (about half a column), while Francophones are nearly unshockable
(two words).

Tom Wyant



-- 
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Reply via email to