Password generation
I was always iritated about having multiple passwords to different systems. One day I’ve heard about something named “password generation system”, which is useful to recover password to any system, if you forgot one. I this case you treat as a given, that the name of system, or page address, has to be a part of algorhtym. Just anything, that will be seed for our password, to ensure, that anytime we’ll build a password for one purpose, the password will be the same. I was thinking very long for such alhorythm, which would use such seed, and wouldn’t be breakable by having two passwords. Furthermore this shoudl be simple enough to make any needed calculation in an instant, by your self.
Well there came a moment, that I came up to this, that by my present knowledge I can’t develop algorythm, that mach my criteria. But as I was thinking about some ways to encode password, I came up with few ideas of more complex ones, that in the same time are unbreakable without some data. At least I think so. That’s when I started to think about cellphone application, that if configurated once (and protected with a SINGLE password) will give us a password to any service, we need.
The Idea is very simple. You use a fragment of the md5 key calculated from a given string, for example it will be always 8 first digits. The next problem is, what should be used as this string… the addresses are to obvious. So here is what I’ve designed:
At the first start:
- choose any file, which is copied by application and hiden in application data.
- choose, if your string is added at front, or at the end of file
- choose, which signs will compound the password.
At further use:
- Enter a string(f.e. page address) and you have md5 key given from file with added string.
Since I didn’t do anything in J2ME yet, nevermind the simplicity of this application, I don’t think it’ll show up anytime soon. Nevertheless I have to tell about some possible vunurelabilities:
- everywhere we go, we have to cary a phone, or other device with application installed on it (lose of phone it’s problem with seed file, if we don’t have a backup)
- if the unwanted person will break a password for application, he/she can generate any password he/she wants
- it isn’t very comfotable, if you need to use this application for services, you use very often.
Posted on 23 May 2008
Under: Programming | No Comments »
english
polski