4 ms·
The password length defaults to too short, and in some circumstances is seeded poorly. https://security.stackexchange.com/questions/77345/security-of-lastpass-
by chalst 8y ago
The password length defaults to too short, and in some circumstances is seeded poorly.
https://security.stackexchange.com/questions/77345/security-of-lastpass-password-generator/77408 https://security.stackexchange.com/questions/77345/security-...
- crazygringo 8y agoYou can change the password length to whatever you want... and your link says it uses window.crypto functionality which appears to be supported in every single browser including back to IE11. [1] So it seems like LastPass-generated passwords are fine? [1] https://developer.mozilla.org/en-US/docs/Web/API/Window/crypto https://developer.mozilla.org/en-US/docs/Web/API/Window/cryp...
- chalst 8y agoProbably. But in the link I posted, did you notice the qualifier "as secure as your browser's implementation of the Web Cryptography API"? Also, AIUI, Webkit implements no PRNG so some Webkit-based browsers might have stupid implementations of the SubtleCrypto object. The thing is, there is a chain of things you have to trust wrt the LP generator: Has the OS implemented the backend API correctly? Were there issues in the browser build that mess up the entropy derived from the OS seed? Has the Javascript done anything stupid? In comparison, I have complete confidence in the entropy of the passwords I generate via CLI. Wrt. password length: yes you can change it. But the dialog is a bit of inconvenience that tilts away from the hassle of switching to my terminal and typing "suggest-password". And I have something of a moral objection to password generators that default to insufficient entropy.