--- a/auth/auth.go	Sun Oct 25 11:48:53 2015 -0400
+++ b/auth/auth.go	Thu Oct 29 21:25:12 2015 -0400
@@ -18,7 +18,7 @@
 	bcryptCost = 12
 	// we only generate passwords from lowercases for non-ambiguity
 	lowercases = "abcdefghijklmnopqrstuvwxyz"
-	template   = "____-____-____-____"
+	template   = "????-????-????-????"
 )
 
 var (
@@ -27,7 +27,7 @@
 )
 
 var (
-	ShortEntryError      error = errors.New("multipass/auth: password entry must have 3 or more fields")
+	WrongLengthError      error = errors.New("multipass/auth: password entry must have 3 fields")
 	BadIDError                 = errors.New("multipass/auth: ID field invalid")
 	Base64Error                = errors.New("multipass/auth: can't decode base64 data")
 	LongDescriptionError       = errors.New("multipass/auth: description must be less than 255 bytes")
@@ -43,15 +43,14 @@
 	id          uint64
 	hash        string
 	description string
-	rest        []string
 }
 
 // EntryFromShadow creates a new entry from a line in a multipass shadow file.
 // The line should not end in a newline.
 func EntryFromShadow(shadow string) (*Entry, error) {
 	segments := strings.Split(shadow, ":")
-	if len(segments) < 2 {
-		return nil, ShortEntryError
+	if len(segments) != 3 {
+		return nil, WrongLengthError
 	}
 	entry := new(Entry)
 	id, err := strconv.ParseUint(segments[0], 10, 64)
@@ -60,14 +59,11 @@
 	}
 	entry.id = id
 	entry.hash = segments[1]
-	if len(segments) > 2 {
-		description, err := base64.StdEncoding.DecodeString(segments[2])
-		if err != nil {
-			return nil, Base64Error
-		}
-		entry.description = string(description)
-		entry.rest = segments[3:]
+	description, err := base64.StdEncoding.DecodeString(segments[2])
+	if err != nil {
+		return nil, Base64Error
 	}
+	entry.description = string(description)
 	return entry, nil
 }
 
@@ -114,16 +110,14 @@
 		e.hash,
 		base64.StdEncoding.EncodeToString([]byte(e.description)),
 	}
-	segments = append(segments, e.rest...)
 	return strings.Join(segments, ":")
 }
 
 func genPassword() []byte {
 	password := []byte(template)
-	for group := 0; group < 4; group++ {
-		base := group * 5
-		for chr := 0; chr < 4; chr++ {
-			password[base+chr] = randChr()
+	for i, chr := range password {
+		if chr == '?' {
+			password[i] = randChr()
 		}
 	}
 	return password