Selecting Passwords

A tool can crack your password just by trying all words in the dictionary. So you must disguise them. Add digits, mix the case. This little program will generate you an impossible to guess password. If want to make sure I am not keeping a copy, download the source, check the program out, and run it on your own machine.

java needed

If the print is too small to see, use the Opera browser and zoom. Or copy/paste the generated password blind.

Implementing Passwords

In a highly secure system, each end has a public and private key. They each encrypt and digitally sign a random message for the other to establish identity. Even these have to be carefully designed to withstand a man-in-the-middle attack.

There are some lower tech alternatives:

• If you have Java on both ends, the server could send a random string of bytes to the client. The client could concatenate that with a string of bytes representing the password, then run it through a SHA-1 or MD-5 digest and send it back to the server. The server does the same thing and compares its version with the client’s.
• If the server is C++ it won’t necessarily have access to a SHA-1 or MD-5 digest. You could then have to come up with a digest function you can implement easily in C++. You could use an Adler or CRC with some wrinkle to make it a tad harder to crack, or use one of the HashCode algorithms.
• If you want to avoid a two way exchange for faster login, let the random key be the time of day stamp in UTC. The client sends it along in plaintext with the digest. The timestamp is rejected if it is too far from "now".
• For something even lower tech, but unfortunately easy to crack, try XORing the bytes of the password with something you change periodically.
• Base64 alone, cascaded Base64 or ROT13 is no protection at all.

Digest Passwords

Typically raw binary bytes generated by such authentication schemes are exchanged in base64.

Tomcat has a single signon so that all applications in a realm share the same set of user-ids and passwords. If a user logs in to one application, he is logged in to all. This scheme uses cookies to authenticate each request.

Tomcat lets you configure the tables and columns to automatically look up and validate passwords. Caucho Resin similarly lets you configure SQL queries to automatically find the passwords in your database.

Graphical Passwords

Passwords at the Client

Passwords at the Server

Java Servlets defines a simple password scheme controlled entirely by a flat file web.xml. This would be suitable for a small company where the list of users and passwords could be maintained with a text editor by the system administrator.

The best approach (for expandability) is to incorporate a third party SSO (single sign-on) (some application servers come with one). This allows you to add new applications and share the login across them with a minimum of effort. Also, they typically plug into an existing LDAP taking user and password management out of the application’s hands. This allows corporations to take advantage of existing LDAP data when deploying applications.

Tomcat offers five different interfaces to databases of passwords. JDBCRealm lets you interface to a SQL users and userroles tables. You configure the name of your table containing the user ids and passwords (among other things) and your roles table which describes which roles a user can play. You assign Tomcat a userid/password and jDBC connect string to give it with read-only access to your database to perform the authentications. It is much simpler than it first looks.

Puzzles

• How do you arrange for a timeout, so that after a period of inactivity, the login expires an the user has to re-enter his password. I know how to do it from first principles, but not with Tomcat.
• Just how much does the Applet get in involved with cookies, or do they get piggybacked behind its back.
• Does Java Authenticator understand the Tomcat cookie scheme?