Looking for feedback. I am building a django app where users are given randomly generated passwords.
Currently, the password is being generated using the make_random_password() function in django auth.
However, early feedback is that the emails are too hard to remember (even though the users can change them).
This is a closed (invite only) app, but it lives on the internet. with about 600 users total. I had a solution that I feel is is somewhat insecure, but I wanted to run it by SO users, as it solves the feedback issue
In my settings.py file, I have created two lists, one contains about 20 car names, the other about 40 verbs (which are capitalized).
I was going randomly select one from each list, join them together and then append a few random chars to the end.
All passwords would be at least 9 chars long and when saved are hashed using django’s set_password() function
The biggest issue I see is that if someone were to gain access to the SFTP server they would then have access to my code AND hence a template for cracking the pwords.
BUT they would also have db access etc, so is it really a concern?
You should always assume that the attacker has access to your password generation scheme. Basing your security on the assumption that he doesn’t is trusting security through obscurity. Obscurity can give a nice security bonus but you should never rely on it.
You must assume the attacker knows the content of both lists. For example he can simply register about 40 times, and then knows a significant part of them.
Your car-names combined with the verbs have about 9.6(=log2(20)+log2(40)) bits of entropy. Corresponds to about 2 random characters. That’s very low.