* xyzzy
In the first two of this three-part series, I’ve been asking, “What’s a good password?” and looking at password generators available free on the Web. This time I look at a couple of password generators based on the classic paper by Morrie Gasser, “A Random Word Generator for Pronounceable Passwords” published by MITRE in 1975 and available online.
The “Java Password Generator” by Tom Van Vleck is programmed in Java (with source code available). The demonstration version doesn’t offer any parameters for controlling the output, but it produces random pronounceable passwords with alternating consonant groups and vowels.
Here’s a sample:
tickmeni
diarrati
ospussit
sivestat
fetiplea
catontan
atuorthw
ustempre
bleinian
gnappism
The author recommends, “The best way to use this generator is to take its output it in ways known only to you. Make some letters capital, or insert punctuation and numbers.” He also points out, “Steve Weintraub has written a nice pre-packaged version called XYZZY for Mac and Windows.”
Weintraub’s freeware program is 183 KB and uses digram frequencies to optimize the readability of the random strings:
“The algorithm used to create the passwords is based on work of several people. In simple terms, it uses the statistics of how often one letter appears next to another and generates passwords based on these trends. For example, if a password contains the letter ‘Q’, then it is very likely that it will also contain a ‘U’ right beside it, because this is almost always the case in real words.”
This utility lets you choose the number of characters, the number of passwords to create and whether to include numbers. Here are some examples from a run of the program using 10 characters including numbers:
garmatta63
emidaener1
melizedo83
ramenejor9
dacealarp7
condeded86
micadend76
lichoozo01
untratlyk1
tizemish97
The author writes, “For added fun, try to think of definitions for the words that xyzzy generates.” I would say, “for added security” because such mnemonics make it easier to remember the password without writing it down.
I like this program so much that I am now using it to help generate my own passwords with the addition of a few strategically placed special characters (which I’m not going to tell you)
My thanks to the crew of the Norwich University Help Desk for drawing my attention to xyzzy and thus suggesting the topic of this column and the preceding two.
