Show HN: Correct Horse Battery Staple password generator

Post by 1e-9 » Tue, Jun 16, 2020, 5:02 AM UTC

ThA0x2 wrote: post #50

1e-9 wrote: post #45

Earlier quoted context omitted.

Interesting. They stopped using /dev/urandom as the default random file in version 7.3, which created the insecure default situation. Later, in version 8.6, they updated to use a default nonce from /dev/urandom. It's odd that the documentation has not be updated. Perhaps it's because the latest version will still default to an insecure nonce if there is no /dev/urandom?

If you're on a Linux OS that's from ~2013 or later, then you're most likely on a version of coreutils that will default to /dev/urandom. The master branch of coreutils is using getrandom(2). It will continue to draw entropy from the urandom source by default.

Post by 1e-9 » Tue, Jun 16, 2020, 6:52 AM UTC

ThA0x2 wrote: post #52

1e-9 wrote: post #51

Earlier quoted context omitted.

The latest versions of RHEL/CentOS 6 use coreutils version 8.4, so I assume their shuf defaults to insecure. I imagine that RHEL 5 ELS must have the same issue. I don't know of any other currently-supported Linux or BSD versions that might be a problem.

RHEL 5 is from 2007, and is already past end of life (end of extended support is this November). RHEL 6 is from 2009, and it's end of life is this November. Both of those OS are not from 2013 or later. They may have minor versions that were released later, but minor versions typically don't make significant changes to core packages. RHEL 7 (2014) and Ubuntu 13.04 both have coreutils 8.20 or newer.

Post by noneeeed » Tue, Jun 16, 2020, 7:22 AM UTC

CPLX wrote: post #31

Can someone explain to me why 1password doesn't have something like this built in? You can use words, or random/symbols, but not both. Which fails miserably every time you're faced with some sort of silly password requirement to have a symbol and a number and a capital or whatever.

Post by pkhamre » Tue, Jun 16, 2020, 9:21 AM UTC

mlaci wrote: post #56

Problem with generators and this scheme, they allow regeneration. Most people not using the first version, they generate a new until they like it enough to stop, which is not that random anymore as they think.

Post by setr » Tue, Jun 16, 2020, 9:38 AM UTC

pkhamre wrote: post #57

mlaci wrote: post #56

Problem with generators and this scheme, they allow regeneration. Most people not using the first version, they generate a new until they like it enough to stop, which is not that random anymore as they think.

So you're saying that generating a new password looses entropy?