In my previous role working as a security manager for a large retailer, I developed some password tools for various purposes, primarily to help non-security people with some of the basics. I licensed them under the GPL, and I think it’s about time they saw the light of day.

There are a couple of tools, which I will explain below. They’re all written in JavaScript, primarily because it is cross-platform, but can be centrally hosted. They all work in Firefox and Internet Explorer, although the automatic copy to clipboard functionality of the service desk tool is IE only.

The intention is for the tools to be placed into your organisation’s intranet somewhere. I found they came in much use, allowing me to reference a specific tool and setting rather than esoteric password theory in documents. For example, security standards documents would say “Service account passwords should either be generated by the password generator set to the service account setting, or be rated as “very strong” by the password strength checker”, which is far more practical than quoting a list of password rules.

Being centrally hosted also allows updates to be made immediately in the case of a policy change, new common password addition, or bug. This also allowed web logs to provide an audit trail of who was using the tools. Particularly useful in the case of monitoring service desk activity e.g. If the service desk records 100 password resets, and the tool only saw 10 hits, you know something’s up.

If you’re a tactile learner, you can grab them here.

Password Strength Checker

This tool was written in response to the poor attempts at password strength checkers seen on many sites. They do basic checks for upper, lower-case characters and numbers. This allows passwords like “Password1” to be marked as “strong.” Primarily based on Tyler Atkins’ entropy and common word checker, I put together a more advanced utility. This will check the chosen password for:

• Length (over 8 characters)
• Character sets (lowercase, uppercase, numbers, special characters)
• Frequency (checks for common sets of characters e.g. “u” following “q”, biased to English)
• Common Words (checks that common words aren’t used e.g. Password1)

I’ve added a progress bar from Gerd Riesselmann, and a key for guidance. I’ve also eased the password strength requirements to better fit reasonable corporate password policies. These can be easily modified in the code though.

There are two versions provided, one which displays the results of the entropy calculations, and one which does not (user’s rarely care).

Password Generators

There are three password generators, each with a different audience in mind.

Full Password Generator

The full password generator is the most complex and has a number of features:

• Generate random passwords of varying complexity based on a “usage” selector such as “user”, “administrator” or “service account”. These match up to the complexity key in the strength checker.
• Generate lists of passwords to be used as distributed One-Time-Password lists. This is useful if passwords are regularly required between two parties to avoid using a static password. The list can be delivered via an alternative medium than the data being transmitted, and an agreed rotation period set up, such as a new password to be used “every day” or “every week”.
• Create a NATO alphabet version of the password for speaking over the phone with the “will be spoken” option

The actual password generation code was courtesy of the no-longer-available CryptoMX tools, and the NATO alphabet conversion code was courtesy of L. Bower.

Service Desk Password Generators

The service desk password generators were created to help the service desk stop resetting everyone’s password to the same thing. It’s one of the most pervasive security problems in any organisation, the service desk are told to reset passwords to some common password like “abc123”, “Password<x>” or “<username>”. Most user’s know it, and if you do ever investigate service desk password resets, will find some serious abuses going on. This tool is a quick and dirty way to provide more reasonable alternatives for the service desk to use.

It’s basic features are:

• A very simple interface and instructions
• A basic and somewhat unique password is generated
• A “pronounceable” version of the password is created in the NATO alphabet for speaking over the phone
• The password is copied to the clipboard (IE only) for pasting into whatever reset tool is in use

There are two versions, the first generates a strong random password, and the second uses one of a list of weak base words, with random numbers put on the end. The second was created after push back from the service desk agents saying that user’s were complaining about the random passwords. I don’t like the second version, because it is still fairly predictable, and someone internally could pull out the passwords and create a simple password list to feed to any number of tools. If you are going to use the second version, please use your own list of words, ideally several thousand to increase the entropy. The current list was created by taking the top 500 6-digit words from the Unix English (en) dictionary, and removing complex ones.

These tools where originally written when I was an employee of Deloitte South Africa, and while necessarily under the GPL due to included code, are still published here with permission of them. They have however, been updated since then on SensePost’s coin.