Asking for user feedback: how does one use z-tokens?

[cipriancraciun]

In relation to #17 and #18, I would like to hear from actual users of z-tokens how they have integrated it in their workflow, or how other potential users might want to integrate it.

I know that passwords are security sensitive pieces of information, and disclosing one's password habits might give quite a lot of information to possible attackers, but knowing how ones would use it might help me make the tool better.

(In a follow-up reply, I'll disclose my usage patterns.)

[cipriancraciun]

I use z-tokens (and it's former Python implementation tokeng still present in the v0.2.1 tag) mainly for the following purposes:

• generating online authentication passwords of the following patterns:

  • cv:4 (i.e. rebo lori qalo faqe without spaces) that has ~53 bits of entropy;
  • cv-plus-a:4 (i.e. zomu celi jile 1521) or cv-plus-b:4 (i.e. nuda yuho qegu WB80) or cv-plus-c:4 (i.e. fitu dizo neqi DI5<), that have almost exactly the same entropy as before, but which I choose in the case the online service asks for "complex" passwords;

• generating "bearer tokens" to be used by services or automated scripts to authenticate to various other services:

  • bytes-hex:16 (i.e. 776147ff47fbeaff3c02fd4d07d47626) which have 128 bits of entropy, good enough even for usage as direct encryption;

• generating strong long-term encryption passwords (especially for Linux cryptsetup open without LUCKS keys):

  • bytes-hex:64 which have 512 bits of entropy, good enough to be used for encryption without any additional iterations or KDF (besides a simple hash that cryptsetup open supports); (these are then wrapped with GnuPG which does have proper security;)

• generating various random network addresses:

  • ip-127 (i.e. 127.115.174.29) that allow me to give each service it's own loopback IP address that then I can forward (via HAProxy, iptables NAT, or even SSH);
  • ip-mac (i.e. 02:e4:46:40:ec:f6), namely plain Ethernet MAC addresses that always start with 02: which according to the standard are "locally administered", thus allowing me to have multiple "network identities" for the various systems on multi-boot systems;

• generating 32 bit or 64 bit hex numbers for various identifiers in my projects (like error codes);