6 ms·

Password Generator

7 points by dbremmen 7y ago

TheDong 7y ago
This generates the password on a server you don't control. I recommend not using it. Using 'tr -dc A-Za-z0-9 < /dev/urandom | head -c $length' is more secure and available on your linux or osx machine even more easily than waiting a second for a server to run some java off in a magic black box.
- archgoon 7y ago
  If you get "tr: Illegal byte sequence" you can prepend 'LC_ALL=C ' before the 'tr' to prevent tr from trying to treat the stream as a unicode sequence.
- aarreedd 7y ago
  This isn't a great site or anything and you're right that password should be generated client-side. But not everyone is one Linux or Mac and sometimes it's just easier to Google "password generator" than remembering that command. Your comment reminds me of the infamous Dropbox comment: https://news.ycombinator.com/item?id=9224 https://news.ycombinator.com/item?id=9224
  - dbremmen 7y ago
    Yes you right I just created this password generator for fun in the browxy online compiler. The UI is auto-generated with a tool that the site provide. I'm just curious why this tool caused so many interest and wondering what other tools can be built that cause this type of interest...
  - pvg 7y ago
    Password managers and browsers themselves can generate passwords. Generating passwords with a website it a terrible idea, googling "password generator" and going to some random website is an even worse variant of the same idea.
    - pabletec 7y ago
      this is not a random website, this is "the browxy" site
      - TheDong 7y ago
        I find it bizarre that you have exactly 3 comments in 5 years, all of which are on dbremmen's posts, who happens to be the creator of browxy [0]. Forgive me if I don't trust my password generation on the servers of someone who is either sock-puppeting, or having a friend do something that does not look all that different. Even if I trust the person who runs the browxy website and servers, I don't trust my password generation to a multi-tenet environment. Browxy is running this code in docker containers on a machine with many other docker containers running arbitrary user-submitted code. The intel vulnerabilities over the past year or so have made it incredibly clear that running sensitive code on the same CPU as totally untrusted and possibly malicious code is a dangerous proposition and there are numerous potential side channels to exfiltrate data. Trusting password generation to a website that generates passwords on a shared machine is even worse than the usual password generation website which at least uses javascript/securerandom to do it on my CPU. [0]: https://news.ycombinator.com/item?id=11719439 https://news.ycombinator.com/item?id=11719439
        oefrha 7y ago
        If you look at submissions of these two accounts it’s even worse.
  - TheDong 7y ago
    There are plenty of actually secure and usable password generators, such as the one integrated with keepass / 1password / etc. I'm sure there are secure websites to do it too. This isn't it though. The dropbox comment isn't relevant. It's a bias to say "I remember this thing was criticized in a similar way but succeeded" and map that on to "so other criticisms aren't valid". It's far more often than things seem unlikely to succeed to critics, and then quietly fail than that things seem unlikely to succeed to critics, but then succeed. After all, almost everything ever made doesn't see widespread success. Our brain does remember the latter cases more, and that leads to the bias. I see it most commonly with the phrase "X started out small too" as a defence for why something small will grow to something big, when in reality that's cherry picking massively.
    - oefrha 7y ago
      > there are secure websites to do it too. Such websites have to be audited every single time you use it. Even if I only have a web browser and nothing else I would combine random.org and diceware.com instead of trusting some website.
- iudqnolq 7y ago
  You can also try indexing into /usr/share/dict/words for a correcthorsebatterystaple-style password. I'm sure there's a cute on-liner, I did it in Python because that took a lot less time than all the man page searching how to do it with Unix text processing tools would have taken. Yes, it would be better to remember random characters of the same length. But most people don't. I personally have one password I use to sign into 1password and a small other set of critical services, and longer random passwords for everything else. I personally don't worry about nation state adversaries so I can make myself less vulnerable to mass automated attacks and targeted attacks by non-experts. It's important to remember not to let perfect be the enemy of the good, and important not to discount the cost of DOSing yourself. I reduced my security after I lost access to something of value.
  - archgoon 7y ago
    shuf -n 4 /usr/share/dict/words | tr '\n' ' ' && echo
    - iudqnolq 7y ago
      Thanks! I'm trying to learn bash, and it's going slow (right now still trying to fully understand set -euxo pipefail). I would not have guessed that a command existed to make random permutations, I was expecting an awk incantation.
  - TheDong 7y ago
    Your cute one-liner for 4 words: sort --random-sort /usr/share/dict/words | head -n 4 | tr -d '\n' You may wish to omit words that have "'" characters, in which case you may throw in a grep -v "'" after the sort.
    - iudqnolq 7y ago
      Thank you. I think it's a testament to the power of unix that two different people responded with solutions using different commands. I should have thought of sort, it feels natural in retrospect. Am I right in believing bash pipes are lazy enough that that won't require sorting the whole file, just pulling out four random lines? As a side note, I'm guessing grep had -v before it became a standard for verbose? That's one of the hardest parts: it seems open source tools never change UI to help new users at the expense of old ones having to change workflows. A valid way of doing it, and as someone who's never contributed to anything open source I have no place to criticize. Just saying makes it harder. (And I'm realizing I haven't used any closed source software from a comprable time, so I have no idea if this is FOSS-specific)
- deleted 7y ago
  [deleted]
oeuviz 7y ago
I created something similar ~2 decades ago in perl. It would spit out a long list of passwords in text format so you could chose one without the server knowing what you chose. Today, keepass does the job just fine.
- dbremmen 7y ago
  That's a nice idea! I just created this password generator for fun like other utilities in java but I don't know just this one generated so many interest. You can see the source code using the button to the bottom right (the one that has 1's and 0's)
- oefrha 7y ago
  Instead of a search space of 1 you augmented it to N which is likely <= 2^10. Still a pretty terrible idea to trust a password like that.
  - oeuviz 7y ago
    I agree, however, it ran on our own server so it was OK-ish.
dbremmen 7y ago
Thanks for all the nice comments that are intended with good karma. What other feature can I add to this password generator that is useful? I agree that using linux is more secure but for passwords that are not as important I think this tool works fine, also you don't need to remember a big line of code and you can execute it on your mobile phone
- tobr 7y ago
  It seems surprisingly complicated. Why is there a “start” and “stop” button? Why does it take so long for it to generate a random string? Why is there a “console” that just seems to show the page template?
  - dbremmen 7y ago
    You right! Console and stop button are not necessary. The UI is generated with a UI creation tool that match program arguments with UI widgets (see: https://ibb.co/phQQFxr https://ibb.co/phQQFxr). In this case there is an option missing to don't show the stop button and the console (These are shown due that you can create interactive programs with browxy)
SomewhatLikely 7y ago
I'm a fan of the apg linux command because it generates somewhat phonetically prounceable passwords and of course runs locally. https://help.ubuntu.com/community/StrongPasswords#APG https://help.ubuntu.com/community/StrongPasswords#APG
known 7y ago
I use </dev/urandom tr -dc 23456789~*@#$%_+-=qwertQWERTasdfgASDFGzxcvbZXCVB | head -c13; echo ""
ozgrozer 7y ago
A better version of this might be https://piper.gq/ https://piper.gq/ that I made last month.

7 points by dbremmen 7y ago

This generates the password on a server you don't control. I recommend not using it. Using 'tr -dc A-Za-z0-9 < /dev/urandom | head -c $length' is more secure and available on your linux or osx machine even more easily than waiting a second for a server to run some java off in a magic black box.

archgoon 7y ago
If you get "tr: Illegal byte sequence" you can prepend 'LC_ALL=C ' before the 'tr' to prevent tr from trying to treat the stream as a unicode sequence.
aarreedd 7y ago
This isn't a great site or anything and you're right that password should be generated client-side. But not everyone is one Linux or Mac and sometimes it's just easier to Google "password generator" than remembering that command. Your comment reminds me of the infamous Dropbox comment: https://news.ycombinator.com/item?id=9224 https://news.ycombinator.com/item?id=9224
- dbremmen 7y ago
  Yes you right I just created this password generator for fun in the browxy online compiler. The UI is auto-generated with a tool that the site provide. I'm just curious why this tool caused so many interest and wondering what other tools can be built that cause this type of interest...
- pvg 7y ago
  Password managers and browsers themselves can generate passwords. Generating passwords with a website it a terrible idea, googling "password generator" and going to some random website is an even worse variant of the same idea.
  - pabletec 7y ago
    this is not a random website, this is "the browxy" site
    - TheDong 7y ago
      I find it bizarre that you have exactly 3 comments in 5 years, all of which are on dbremmen's posts, who happens to be the creator of browxy [0]. Forgive me if I don't trust my password generation on the servers of someone who is either sock-puppeting, or having a friend do something that does not look all that different. Even if I trust the person who runs the browxy website and servers, I don't trust my password generation to a multi-tenet environment. Browxy is running this code in docker containers on a machine with many other docker containers running arbitrary user-submitted code. The intel vulnerabilities over the past year or so have made it incredibly clear that running sensitive code on the same CPU as totally untrusted and possibly malicious code is a dangerous proposition and there are numerous potential side channels to exfiltrate data. Trusting password generation to a website that generates passwords on a shared machine is even worse than the usual password generation website which at least uses javascript/securerandom to do it on my CPU. [0]: https://news.ycombinator.com/item?id=11719439 https://news.ycombinator.com/item?id=11719439
      - oefrha 7y ago
        If you look at submissions of these two accounts it’s even worse.
- TheDong 7y ago
  There are plenty of actually secure and usable password generators, such as the one integrated with keepass / 1password / etc. I'm sure there are secure websites to do it too. This isn't it though. The dropbox comment isn't relevant. It's a bias to say "I remember this thing was criticized in a similar way but succeeded" and map that on to "so other criticisms aren't valid". It's far more often than things seem unlikely to succeed to critics, and then quietly fail than that things seem unlikely to succeed to critics, but then succeed. After all, almost everything ever made doesn't see widespread success. Our brain does remember the latter cases more, and that leads to the bias. I see it most commonly with the phrase "X started out small too" as a defence for why something small will grow to something big, when in reality that's cherry picking massively.
  - oefrha 7y ago
    > there are secure websites to do it too. Such websites have to be audited every single time you use it. Even if I only have a web browser and nothing else I would combine random.org and diceware.com instead of trusting some website.
iudqnolq 7y ago
You can also try indexing into /usr/share/dict/words for a correcthorsebatterystaple-style password. I'm sure there's a cute on-liner, I did it in Python because that took a lot less time than all the man page searching how to do it with Unix text processing tools would have taken. Yes, it would be better to remember random characters of the same length. But most people don't. I personally have one password I use to sign into 1password and a small other set of critical services, and longer random passwords for everything else. I personally don't worry about nation state adversaries so I can make myself less vulnerable to mass automated attacks and targeted attacks by non-experts. It's important to remember not to let perfect be the enemy of the good, and important not to discount the cost of DOSing yourself. I reduced my security after I lost access to something of value.
- archgoon 7y ago
  shuf -n 4 /usr/share/dict/words | tr '\n' ' ' && echo
  - iudqnolq 7y ago
    Thanks! I'm trying to learn bash, and it's going slow (right now still trying to fully understand set -euxo pipefail). I would not have guessed that a command existed to make random permutations, I was expecting an awk incantation.
- TheDong 7y ago
  Your cute one-liner for 4 words: sort --random-sort /usr/share/dict/words | head -n 4 | tr -d '\n' You may wish to omit words that have "'" characters, in which case you may throw in a grep -v "'" after the sort.
  - iudqnolq 7y ago
    Thank you. I think it's a testament to the power of unix that two different people responded with solutions using different commands. I should have thought of sort, it feels natural in retrospect. Am I right in believing bash pipes are lazy enough that that won't require sorting the whole file, just pulling out four random lines? As a side note, I'm guessing grep had -v before it became a standard for verbose? That's one of the hardest parts: it seems open source tools never change UI to help new users at the expense of old ones having to change workflows. A valid way of doing it, and as someone who's never contributed to anything open source I have no place to criticize. Just saying makes it harder. (And I'm realizing I haven't used any closed source software from a comprable time, so I have no idea if this is FOSS-specific)
deleted 7y ago
[deleted]

oeuviz 7y ago

I created something similar ~2 decades ago in perl. It would spit out a long list of passwords in text format so you could chose one without the server knowing what you chose. Today, keepass does the job just fine.

dbremmen 7y ago
That's a nice idea! I just created this password generator for fun like other utilities in java but I don't know just this one generated so many interest. You can see the source code using the button to the bottom right (the one that has 1's and 0's)
oefrha 7y ago
Instead of a search space of 1 you augmented it to N which is likely <= 2^10. Still a pretty terrible idea to trust a password like that.
- oeuviz 7y ago
  I agree, however, it ran on our own server so it was OK-ish.

dbremmen 7y ago

Thanks for all the nice comments that are intended with good karma. What other feature can I add to this password generator that is useful? I agree that using linux is more secure but for passwords that are not as important I think this tool works fine, also you don't need to remember a big line of code and you can execute it on your mobile phone

tobr 7y ago
It seems surprisingly complicated. Why is there a “start” and “stop” button? Why does it take so long for it to generate a random string? Why is there a “console” that just seems to show the page template?
- dbremmen 7y ago
  You right! Console and stop button are not necessary. The UI is generated with a UI creation tool that match program arguments with UI widgets (see: https://ibb.co/phQQFxr https://ibb.co/phQQFxr). In this case there is an option missing to don't show the stop button and the console (These are shown due that you can create interactive programs with browxy)

SomewhatLikely 7y ago

I'm a fan of the apg linux command because it generates somewhat phonetically prounceable passwords and of course runs locally. https://help.ubuntu.com/community/StrongPasswords#APG https://help.ubuntu.com/community/StrongPasswords#APG

known 7y ago

I use </dev/urandom tr -dc 23456789~*@#$%_+-=qwertQWERTasdfgASDFGzxcvbZXCVB | head -c13; echo ""

ozgrozer 7y ago

A better version of this might be https://piper.gq/ https://piper.gq/ that I made last month.