23.5 Tips on Using Passwords

Lots of computer programs use passwords for user authentication. Beyond the standard UNIX password, users soon find that they have passwords for special electronic mail accounts, special accounting programs, and even fantasy role-playing games.

Few users are good at memorizing passwords, and there is a great temptation to use a single password for all uses. This is a bad idea. Users should be encouraged to not type their login password into some MUD that's running over at the local university, for example.

As a programmer, there are several steps that you can take in programs that ask for passwords to make the process more secure:

1. Don't echo the password as the user types it.

   Normally, UNIX turns off echo when people type passwords. You can do this yourself by using the getpass() function. In recent years, however, a trend has evolved to echo asterisks (*) for each character of the password typed. This provides some help for the person typing the password to see if they have made a mistake in their typing, but it also enables somebody looking over the user's shoulders to see how many characters are in the password.

2. When you store the user's password on the computer, encrypt it.

   If nothing else, use the crypt() library function. Use random numbers to choose the password's salt. When the user provides a password, check to see if it is the original password by encrypting the provided password with the same salt.

   For example, the following bit of a simple Perl code takes a password in the $password variable, generates a random salt, and places an encrypted password in the variable $encrypted_password:

   $salts="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789./";
   srand(time);
   local($s1) = rand(64);
   local($s2) = rand(64);
   $salt = substr($salts,$s1,1) . substr($salts,$s2,1);
   $encrypted_password= crypt($password,&salt)

   You can then check to see if a newly provided password is in fact the encrypted password with this simple Perl fragment:

   if($encrypted_password eq
     crypt($new_password, $encrypted_password){
     print "password matched.\n";}

3. If you need access to crypt() from a shell script, consider using /usr/lib/makekey, which provides much the same functionality.