I've asked my XOOPS installation to email me my password. I expected to get my current password, but instead I've got an email telling me to click on a link to generate a new password. That's not quite what I expected, but it's OK.

However, I was shocked when I got my new password. It was:

whakpenis

If one of my customers would receive something like this, this would NOT be funny at all! How do I control the generation of passwords and avoid situations like this above?

The current password cannot be retrieved, since only the encrypted password is stored in the database, and the encryption is one-way. Thus a new password has to be generated if you lose your password.

The new password is generated by randomly selecting four strings from this array and concatenating them (function xoops_makepass in include/functions.php):

$syllables = array("er","in","tia","wol","fe","pre","vet","jo","nes","al",
"len","son","cha","ir","ler","bo","ok","tio","nar","sim",
"ple","bla","ten","toe","cho","co","lat","spe","ak","er",
"po","co","lor","pen","cil","li","ght","wh","at","the",
"he","ck","is","mam","bo","no","fi","ve","any","way",
"pol","iti","cs","ra","dio","sou","rce","sea","rch","pa",
"per","com","bo","sp","eak","st","fi","rst","gr","oup",
"boy","ea","gle","tr","ail","bi","ble","brb","pri","dee",
"kay","en","be","se");

"wh", "ak", "pen" and "is" are all in that array, so the result you got is possible, although statistically unlikely.

I guess the reason for using pronounceable syllables, rather than a string of random letters or digits, is to make the password easier to remember, while still being hard to guess.

Maybe your example is an argument for using random letters or digits.

Thanks, I thought for a second that one of the developers made a joke by placing this word somewhere in the system.

This is quite funny:

"wh","at","the","he","ck","is","mam","bo"","no","fi","ve","any","way"

Personally I feel that random mumber and letter generation is better, but thats just me. I feel more comfortable getting a weird string of random digits and letters in an email pword reminder, but thats just me