4 ms·
From the previous HN thread on this: To have fun on April Fools' Day we wanted to build something useful and funny: we created a new XKCD-like password generat
by itcrowd 11y ago
From the previous HN thread on this:
To have fun on April Fools' Day we wanted to build something useful and funny: we created a new XKCD-like password generator that can use different languages dictionaries and show a picture for each generated term by searching Google Images. We had a lot of laughs playing around with Italian and English passwords and we hope you'll have as fun with this as we did!
https://news.ycombinator.com/item?id=9304688 https://news.ycombinator.com/item?id=9304688
It should be just for fun and education, anyone foolish enough to use these generated passwords as real passwords is well ... foolish enough. Flaw #1: no HTTPS.
- Udo 11y agoHTTPS does nothing for you in this case. The passwords are generated locally with JavaScript, and there is an option you can check to prevent them being sent back to the server. But even if they actually were generated on the server, HTTPS would be of limited use, since you'd still have to trust the server itself and the people operating it.
- itcrowd 11y agoGood point. However, the dictionaries also need to be transferred to the user and a MITM could easily replace this with his own (flawed) dictionary. Same point: JavaScript injection/modification. HTTPS doesn't guarantee that the dictionary isn't flawed or the JS is secure, but it does guarantee that the received data/scripts/dictionaries are exactly the ones the server intended to send.