Is this secure?
mrkafk at gmail.com
Thu Feb 25 16:03:47 CET 2010
On 2010-02-25 02:31, Paul Rubin wrote:
> It might be helpful if you could say what your application does, or
> anyway give an idea of what its actual security requirements are.
> Generating and emailing someone a random password is a fairly standard
> method for (e.g.) web forums to verify that the person has supplied a
> working email address, basically as a first level spam filter. Your
> scheme is probably ok for that. If you're doing something with more
> demanding security requirements, then as mentioned before, there is a
> whole lot of stuff you have to pay attention to, and focusing narrowly
> on password generation isn't that useful.
OK some data:
1. I'm going to probably use HTTPS (I meant HTTP over SSL, but wrote
HTTP instead of being precise)
2. The app will have GUI and it will be locally installed; it's not
going to be web app, it will just be online in the sense of downloading
data frequently from the net.
3. I can't disclose the details on what the app will be doing, but it's
not going to be terribly security-critical, medium-level at most - what
happens in the app itself is not _directly_ related to money.
4. The app will be based on subscription model, costing $10-$20 per
month. It's not really doing online banking or smth like that.
5. The worst thing that can happen when security of some account is
compromised is that the user will have to reset the password, resending
it to predefined email (I don't really see the way of organizing it in a
I'm thinking about optionally passphrase-securing the password saved in
GUI. In that case 'diceware' approach would be helpful.
I certainly do not want to focus narrowly on password generation: the
entire security model will have to be worked out, but the project didn't
get to that stage yet, it's all still in planning stages. I just wanted
to have this one part (password generation) researched before I get to
other stages so I don't have to implement this later in haste and do
More information about the Python-list