4 ms·

I do not use a browser-based password generator, because of the Javascript insecurity issues (edit: And because I’ve been using a system like this far longer th

I do not use a browser-based password generator, because of the Javascript insecurity issues (edit: And because I’ve been using a system like this far longer than online password managers have existed). I use a shell script, with a small C program to handle the core cryptography, to generate secure passwords. I run the password generator in a terminal window, then copy and paste the password in to the site I am trying to log in to. It’s a fairly complicated shell script, since it also has to deal with nonsense like stupid arbitrary password rules (e.g. Southwest considers an underscore to be a letter, and insists at least one non-letter non-number punctuation is in a password; some places require a password to be 8 characters or shorter; etc.) and also provides login information so I can also remember my username. As recently as 5 or 6 years ago, there were issues with websites which wouldn’t let you copy and paste a password in to their password field; Firefox has always had a “ignore any Javascript which stops pasting” special rule in about:config I had to use. I haven’t seen one of those in a while; developers finally got a clue and realized that password managers exist. One weakness this setup has is that anyone with the “master key” can get all of the password generated by the password generator. My workaround is to use a separate master key in a virtual machine for critical passwords, such as online banking ones. Shameless plug time: https://github.com/samboy/PassGen/ https://github.com/samboy/PassGen/

mgerdts 5y ago
Or openssl rand -base64 12 If a couple attempts at that doesn't generate a password that satisfies complexity requirements, add, remove, or change a character or two before pasting. Change 12 to a larger or smaller number to change the length of the generated pw.
- strenholme 5y ago
  That works, but doesn’t account for the long-term storage of already used passwords, or for the synchronization of passwords generated on different computers. The system I use handles long term storage, generates the same password for a given website multiple times (with support for changing the index used to generate a given website’s password for things like password rotation—each index is a completely different password), allows passwords to be regenerated from memory if one memorizes the master key, and allows one to have a secure generated password without there being a record that one has generated a password for a given site. It has protections against trying to guess the master key based on a generated password and the generated password are themselves difficult to crack (a given password has, by default, 60 bits of entropy, but this can be increased if desired). The weak links are the master key, and the fact the passwords are placed in the clipboard. I use filesystem encryption to protect the master key and only have the master key in two locations (two: Just in case one SSD or computer dies, I have a backup). Browsers do not allow easy access to the contents of one’s clipboard (this is why one has to use Ctrl+V instead of Edit → Paste when using Google Docs in Firefox), so that attack surface, while there, is limited.

mgerdts 5y ago

Or openssl rand -base64 12 If a couple attempts at that doesn't generate a password that satisfies complexity requirements, add, remove, or change a character or two before pasting. Change 12 to a larger or smaller number to change the length of the generated pw.

strenholme 5y ago
That works, but doesn’t account for the long-term storage of already used passwords, or for the synchronization of passwords generated on different computers. The system I use handles long term storage, generates the same password for a given website multiple times (with support for changing the index used to generate a given website’s password for things like password rotation—each index is a completely different password), allows passwords to be regenerated from memory if one memorizes the master key, and allows one to have a secure generated password without there being a record that one has generated a password for a given site. It has protections against trying to guess the master key based on a generated password and the generated password are themselves difficult to crack (a given password has, by default, 60 bits of entropy, but this can be increased if desired). The weak links are the master key, and the fact the passwords are placed in the clipboard. I use filesystem encryption to protect the master key and only have the master key in two locations (two: Just in case one SSD or computer dies, I have a backup). Browsers do not allow easy access to the contents of one’s clipboard (this is why one has to use Ctrl+V instead of Edit → Paste when using Google Docs in Firefox), so that attack surface, while there, is limited.