3 ms·
Even that seems unlikely to be problematic for anything short of literally constant seeds AND a generator becoming extremely popular. The vast majority of peop
by esrauch 6y ago
Even that seems unlikely to be problematic for anything short of literally constant seeds AND a generator becoming extremely popular.
The vast majority of people reuse low-entropy passwords, figuring out what password generator someone used would be a much higher bar than figuring out passwords, and just knowing the insecure generator wouldnt reduce the entropy by that much.
Actually, a password generator on GitHub that generates the password that is literally just seconds-since-1970 would still be a good generator for almost all use cases.
- fanf2 6y agoThis is extremely bad advice. It is shamefully unethical to encourage people to harm their security in this way.
- esrauch 6y agoCan you explain more? I genuinely don't see any plausible threat model that a user running an Math.random() based custom algorithm password generator would be susceptible to, but the same algorithm using SecureRandom one is not. Both cases are so drastically better than manually thinking up a password that it's not even close. I think if there's any gap it would be wrong roll your own password generator at all and you only use ones authored by security experts: just using SecureRandom instead of Random isn't going to somehow magically guarantee you didn't mess up another way and write a low-entropy password generator.