Java Glossary : password

Java definitions: 0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

You are here : home : Java Glossary : P words : password.

password

A word you use to prove that you are truly you to a computer. You will have a password to log on to your operating system, one for each affiliate, and even one for various free services on the web.

Passwords that are easy to guess include the names of loved ones and relatives, words in the dictionary, especially ones with strong emotional connotation like God, whale, love.

A tool can crack your password just by trying all words in the dictionary. So you must disguise them. Add digits, mix the case. This little program will generate you an impossible to guess password. If want to make sure I am not keeping a copy, download the source, check the program out, and run it on your own machine.

java needed

How do you implement passwords?

In a highly secure system, each end has a public and private key. They each encrypt and digitally sign a random message for the other to establish identity. Even these have to be carefully designed to withstand a man-in-the-middle attack.

There are some lower tech alternatives:

If you have Java on both ends, the server could send a random string of bytes to the client. The client could concatenate that with a string of bytes representing the password, then run it through a SHA-1 or MD-5 digest and send it back to the server. The server does the same thing and compares its version with the client's.
If the server is C++ it won't necessarily have access to a SHA-1 or MD-5 digest. You could then have to come up with a digest function you can implement easily in C++. You could use an Adler or CRC with some wrinkle to make it a tad easier to crack, or use one of the HashCode algorithms.
If you want to avoid a two way exchange for faster login, let the random key be the time of day stamp in UTC. The client sends it along in plaintext with the digest. The timestamp is rejected if it is too far from "now".
For something even lower tech, but unfortunately easy to crack, try XORing the bytes of the password with some you change periodically.
Base64 alone, cascaded Base64 or ROT13 is no protection at all.

Servers often don't store bald passwords. They store some sort of digest of them. That way if someone cracks the password file, they still don't know the passwords.

Typically raw binary bytes generated by such authentication schemes are exchanged in base64.

base64 ¤ digest ¤ MD5 ¤ pspaswd: a utility for remotely changing passwords on Windows computers ¤ SHA-1

home	Canadian Mind Products
	mindprod.com IP:[24.87.56.253]
	Your IP:[80.134.30.163]
	You are visitor number 2171.
	Please send errors, omissions and suggestions
	to improve this page to Roedy Green.
	You can get a fresh copy of this page from:	or possibly from your local J: drive mirror:
	http://mindprod.com/jgloss/password.html	J:\mindprod\jgloss\password.html