Re: suggesting passwds to users

[Saqib Ali <docbook.xml () gmail com>]

1) Shoulder surfing might be problem for this type of solution, since
you will need to display the password on the screen for the user to
choose one.

2) In my experience, if the password is randomly generated bunch of
letters, it becomes hard for the user to remember, and they tend to
write them down on a piece of paper and paste on the bottom of the
keyboard. :-(

3) Your system will NOT generate "random" password, instead it will
generate "PSUEDO-RANDOM" passwords. this process can can be duplicated
by an attacker to generate a list of all possible passwords, and use
it in a dictionary attack.


An easier and better approach is to let the user choose their own
password, and then run a dictionary/bruteforce attack on the password
file to make sure they are strong password. If they are not, prompt
the user to change them.

-- 
In Peace,
Saqib Ali
http://validate.sf.net