Comments (2)
The security of haveged is highly contested[1] and I personally believe it is security snake oil. The bigger problem is if you specify that option, and you aren't running something like virtio-rng, or rngd, or haveged, pwgen will just hang, and that's not a great user experience. Realistically speaking, if you are generating a password, worrying about whether you are using a CSRPNG or a "true" RNG is the least of your worries.
[1] https://lwn.net/Articles/525459/
It would probably be a good idea to try using getrandom(2) if it is present, warning if it isn't been fully initialized, but realistically the weakness when using passwords is going to be the human factor.
from pwgen.
@tytso , for the majority computer device, they all provide built-in TPM (https://en.wikipedia.org/wiki/Trusted_Platform_Module), which have integrated hardware random number generator.
The operating system won't fetch new entropy from HRNG if the entropy pool not consume.
I believe the device which support built-in TPM occupy 80% of the world.
Maybe the name of option is -S, --super-secure
which use blocked random source for every character of password.
Which make character independent from each other and completely unpredictable.
Which is helpful to critical environment.
from pwgen.
Related Issues (9)
- `-y` includes backlash HOT 1
- `-B -y` includes symbols that might be confused.
- [feature suggestion] Generate passphrases too
- 8 character passwords are now easily crackable, change the default to 12 HOT 2
- option -c to include at least one capital letter fails HOT 1
- Update SourceForge to point to this GitHub repo
- Modulo Bias HOT 1
- The `-n` flag fails with short passwords HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from pwgen.