3 ms·
The security implication I see is that the password generation is deterministic. My assumption when using a password generator is that it is random.
by lalopalota 4y ago
The security implication I see is that the password generation is deterministic. My assumption when using a password generator is that it is random.
- acdha 4y agoDeterministic doesn't mean predictable by an attacker who can't read system memory but consider also that this could be implemented as simply as a cache: store the generated password for that hostname for n minutes and reuse it for autofill when present. There are a number of hokey things web developers do around security and this would seem like a good hedge against, for example, the ones who split the password and confirmation into separate forms or make you login to their related services because they haven't setup SSO properly.
- tesseract 4y agoI think in this case the behavior is that the initial generation of the password is random, but subsequently it is, shall we say, "trivially deterministic": it (intentionally) always spits out a cached copy of the initial randomly generated password. I think security implications here would mostly apply to cases where you wanted to create multiple accounts on the same website within a short period.
- pontilanda 4y agoThat’s why I mentioned “depending on copy” (or more broadly “UI”). If I’m clicking a “Generate password” button I expected a new password every time. But here it’s an autocomplete-like dropdown rather than an action. By your definition, such dropdown would show different passwords for different fields, even if the second field is a “confirm password” field.