Some of our users complained about the automatically generated
passwords that are sent out when a list is imported or if an admin
subscribes someone. Especially the and ^ characters are major problem because these may be treated as parts of composite characters in some enviroments ( followed by a might be displayed as the same
character as à in HTML) and so on. Also, upper case characters
impose an extra mental burden ;)
Anyway, I modified our Mailman which now has a function (method?) Utils.GetRandomPassword(length)
which generates passwords of the given length with a restricted alphabet, namely: a-x, 2-9, excluding characters o and l as well as digits 0 and 1 which may be confused and y, z (german keyboards swap these, in the past, this cause trouble too ;)
I would like to offer this patch unless there are good reasons why this should be avoided. The main concern is certainly a higher risk to crack such passwords (only 30 possibilities instead of 64) but this could easly be matched by using 5 character passwords:
possibilities strength
64^4 = 16777216 1 30^4 = 810000 0.05 30^5 = 24300000 1.45
As far as I have seen, this patch involves replacing certain calls to GetRandomSeed in a few places such as: bin/add_members, Mailman/Cgi/admin.py, Mailman/MailCommandHandler.py
Any comment?
+gg
-- Gerhard.Gonter@wu-wien.ac.at Fax: +43/1/31336/702 g.gonter@ieee.org Zentrum fuer Informatikdienste, Wirtschaftsuniversitaet Wien, Austria