Is this secure?

[mk]

On 2010-02-25 02:31, Paul Rubin wrote:
> It might be helpful if you could say what your application does, or
> anyway give an idea of what its actual security requirements are.
> Generating and emailing someone a random password is a fairly standard
> method for (e.g.) web forums to verify that the person has supplied a
> working email address, basically as a first level spam filter.  Your
> scheme is probably ok for that.  If you're doing something with more
> demanding security requirements, then as mentioned before, there is a
> whole lot of stuff you have to pay attention to, and focusing narrowly
> on password generation isn't that useful.

OK some data:

1. I'm going to probably use HTTPS (I meant HTTP over SSL, but wrote 
HTTP instead of being precise)

2. The app will have GUI and it will be locally installed; it's not 
going to be web app, it will just be online in the sense of downloading 
data frequently from the net.

3. I can't disclose the details on what the app will be doing, but it's 
not going to be terribly security-critical, medium-level at most - what 
happens in the app itself is not _directly_ related to money.

4. The app will be based on subscription model, costing $10-$20 per 
month. It's not really doing online banking or smth like that.

5. The worst thing that can happen when security of some account is 
compromised is that the user will have to reset the password, resending 
it to predefined email (I don't really see the way of organizing it in a 
different manner).

I'm thinking about optionally passphrase-securing the password saved in 
GUI. In that case 'diceware' approach would be helpful.

I certainly do not want to focus narrowly on password generation: the 
entire security model will have to be worked out, but the project didn't 
get to that stage yet, it's all still in planning stages. I just wanted 
to have this one part (password generation) researched before I get to 
other stages so I don't have to implement this later in haste and do 
smth wrong.

Regards,
mk