Honeywords

Experimental project

This is a sandbox project, which contains experimental code for developer use only.

Description

WARNING, this module is not yet stable! Do not use it!

Honeywords is a module that will generate fake passwords ("honeywords") for
every user on the site. The main use of this module is to make it harder for
an attacker to penetrate your site without being detected (and notifying you
of data leaks that may otherwise have gone unnoticed). It has the side benefit
of making the password database generally less useful for hackers targetting
your users.

Honeywords is an attempt at implementing the Juels-Rivest MIT paper:
http://people.csail.mit.edu/rivest/honeywords/

To be clear, of the many attack scenarios listed in the paper, this module
(and this concept) only addresses a "Stolen [list] of password hashes" scenario.
There are other modules to help you implement security policies addressing the
others. Preventing data leaks in the first place is of course more important,
but damage control should be a part of any responsible security policy.