Creating 10 character passwords...

[asevie]

I've searched but had limited success. So I ask, any tips for generating a 10 character alpa-numeric string randomly?

[asevie]

I came up with this, any weaknesses you can see? This is to create a random password in a table that will have between 7000-10000 records? I made it 8 characters long and I took out zeros and shaped it so that the passwords are a little more memorable, example peg4vev7 or rin4tan8.

Middle ( "bcdfghjklmnpqrstvwxyz" ; ((Random * 100)/5) ; 1 ) &

Middle ( "aeiouaeiouaeiouaeiouaeiou" ; ((Random * 100)/4) ; 1 ) &

Middle ( "bcdfghjklmnpqrstvwxyz" ; ((Random * 100)/5) ; 1 ) &

Middle ( "123456789" ; (Random * 10) ; 1 ) &

Middle ( "bcdfghjklmnpqrstvwxyz" ; ((Random * 100)/5) ; 1 ) &

Middle ( "aeiouaeiouaeiouaeiouaeiou" ; ((Random * 100)/4) ; 1 ) &

Middle ( "bcdfghjklmnpqrstvwxyz" ; ((Random * 100)/5) ; 1 )&

Middle ( "123456789" ; (Random * 10) ; 1 )

[mr_vodka]

See this post.

http://fmforums.com/forum/showpost.php?post/293154/

[comment]

Weaknesses in which aspect?

In terms of calculation, (Random * 100)/5 is exactly the same as Random * 20, so you could simplify that bit. Also, your calc is prejudiced towards the first letter in the string - it will get picked twice as many times as any other. A better formula would be:

Middle ( string ; Ceiling ( Random * Length ( string ) ) ; 1 )

In terms of security, conforming to a pattern of @@@#@@@# makes a brute-force attack more feasible. I'd have to sit down and make some calculations to say how much easier, but I'd guess significantly - especially since the attacker only needs to see 2 passwords to discern the pattern.

[asevie]

Weaknesses in which aspect?

In terms of calculation, (Random * 100)/5 is exactly the same as Random * 20, so you could simplify that bit. Also, your calc is prejudiced towards the first letter in the string - it will get picked twice as many times as any other. A better formula would be:

Middle ( string ; Ceiling ( Random * Length ( string ) ) ; 1 )

In terms of security, conforming to a pattern of @@@#@@@# makes a brute-force attack more feasible. I'd have to sit down and make some calculations to say how much easier, but I'd guess significantly - especially since the attacker only needs to see 2 passwords to discern the pattern.

Classic, the 100/5 or * 20 thing, I was heading off in a different direction when I started and then modified as I went along. Never dawned on me to look at the simple logic to simplify. Thanks for the suggestions!