Password generation
This summer, I wrote some useful java classes for generating random passwords.
Creating random password can be useful in situations such as the following:
- A user forgot his password for our application. Our application sends an email with a new temporary password.
- We want to verify, if a mobile phone number submitted by user is correct. Our application sends an SMS with the new temporary password.
- A user of our application creates a new account for his colleague or family member. Our application creates a temporary password for that account.
- For our own purposes. We want to create a good password for our personal usage.
Creating a random password is not so easy as might by thought. There are two commons errors with this:
- The password generated is an inelegant word, for example: “1something2″. We doesn’t want to send such a password to our potential clients.
- The password generated contains problematic characters, for example: “1″ and “l” or “O” and “0″. There is a problem, when the user rewrites the password from one device to another, e.g.: from a mobile phone to a web application running on a laptop.
That’s why in my application I create password in the form: 2 letters followed by 1 digit followed by 2 letters followed by 1 digit and so on. For example: ab2cd3ef4. Of course, the randomly – generated password contains only safe characters.
I decided to publish this classes to the open source community. You can use my library in your application on LGPL terms. Here is an example of usage:
// create a new one time password for sending via sms or email // (4 chars - about 1e5 unique combination) String password = new PasswordGenerator().generate();
// create a new strong password // (8 chars - about 1e10 combination) String strongPassword = new StrongPasswordGenerator().generate()
Using this library is simply for maven2 fans. If you are not already a fan of maven2, I advise you to become one. In your maven2 application in pom.xml file add a dependency:
<dependency> <groupId>eu.jakubiak</groupId> <artifactId>jakubiak-generators</artifactId> <version>1.0-SNAPSHOT</version> </dependency>
You have to download and build the source by typing:
svn checkout http://jakubiak-generators.googlecode.com/svn/trunk/ jakubiak-generators-read-only cd jakubiak-generators-read-only/jakubiak-generators/ mvn clean install
You should see the success message. Now the installation is completed and you can use this library.
By the way, I also wrote classes for creating a random MD5 number and for creating a random key. MD5 is obvious. The random MD5 numbers are commonly used in web applications, for example as a session cookie. In such a scenario a KeyGenerator class is an improved replacement for the random MD5. The KeyGenerator class create a huge random number bigger than the MD5. (“Bigger” in this case means a potentially larger number is possible). This number is encoded using 62 safe for URLs chars: a-z, A-Z, 0-9. Thanks to that its string representation is shorter and more safe than a hexadecimal encoded MD5.
// create a statistically unique key // (22 chars safely for URLS - about 2e39 unique combination) String key = new KeyGenerator().generate();
// create a random MD5 and encode it hexadecimal // (32chars - 2^128 combination) String md5 = new Md5HexGenerator().generate();
You can also write your own generator, by implementing IGenerator interface.
Now, you have to create PostgreSQL a database and a user. As a password type demojpa.
You have just built the application. The result of maven tasks is a 
It’s time for testing. You have to start a web browser:
On the “Settings” tab you have to select a web camera and a microphone. You have to test publishing. It shouldn’t work, because your IP address doesn’t have permission for the application.
We can find a warning message in Apache Tomcat logs.
You have to put your IP address in the database.
Now you have a working application. It’s time for you to learn.
Next: persistence.xml is a file for JPA, you put entity classes there. red5-services.xml is a very important file, where we you configure Spring beans used by your application. There are also definitions of the database connection. Also, you can put Red5 remote services there.
logback.xml is a log system configuration. red5-core.xml, red5-common.xml, beanRefContext.xml and defaultContext.xml are configuration files for Spring beans used by Red5. If you want to improve Red5 this is the place to hack. red5-web.xml is a file where you can change RTMP name of your application – “demojpa”.
jdbc.properties is a file with database properties. demojpa-servlet.xml is a file for defining MVC controllers of your web application. web.xml is the most important file for war archive, it defines web application components. We have dealt with publisher.swf earlier. pom.xml is a magic Maven file, which describes how maven has to build the application.
Cool, isn’t it?
