tsalzer / pwmake Goto Github PK

There should be two generator types: One creating completely random passwords, one should generate pronounceable passwords (which are, obviously, less secure, but more easy to remember).

Before going public, there is some cleanup to be done:

• Find a name. The current name can't be used.
• Cleanup the README. It's full of useless rubbish right now.
• Write a short manual. Something more fancy may come later.
• Consisider https://travis-ci.org/ (after choosing a better name)

The pwgen default behavior is to fill the screen with passwords to pick from. We can do that. (Mostly, as the termcap stuff seems to be missing...)

Termcap is required for #3. This is probably not too easy.

The pwgen command line interface (CLI) supports a set of options we need to mimick if we want to be "like pwgen". Here's the list of options extracted from the pwgen man-page, as described in the FEATURE_PWGEN file:

mpw [ OPTION ] [ pwlength ] [ numpw ]

-0, --no-numerals     - no numbers
-1                    - one password per line
-A, --no-capitalize   - no need for capital letters?
-a, --alt-phonics     - simply ignore
-B, --ambigous        - no letters which might be confused
-c, --capitalize      - at least one capital letter
-C                    - print output in columns
-N, --num-password=NUM    - generate NUM passwords
-n, --numerals        - at least one number
-H, --sha1=PATH[#SEED]    - seed with hash of file PATH[#SEED]
-h, --help            - help
-s, --secure          - completely random
-v, --no-vowels       - no vowels (or numbers mistaken for vowels)
-y, --symbols         - at least one special character

What we need here is a structure to read the users intent and map as many of these switches to existing functionality. What is not there (or makes no sense) should be silently ignored for now.

Using math/rand, especially when initialized by time.Now(), opens the generated password to very practical attacks.

Please either avoid the use of any king of linear congruential generator (PRNG) or at least put a warning in the README.

I am using pwgen very often and like most of the flags/and functionality it offers. Could be more effective to learn go if this project would have a challenging target.

For some reason the Travis-CI builds on http://travis-ci.org/tsalzer/pwmake are no longer executed. This should be fixed.