vinces1979 / pwgen Goto Github PK

The current version 0.7 on pypi seems to use a non-safe pseudo random generator, which seems pretty dangerous given the name somewhat suggests this makes safe passwords. The github version here seems to use proper system randomness, so I suggest you update it quickly (or alternatively put a note on pypi about the current unsafeness of the version there).

After running pwgen.pwgen(capitalize=True,numerals=True,symbols=True,no_ambiguous=True) for a number of times, I repeatedly get

>>> pwgen.pwgen(capitalize=True,numerals=True,symbols=True,no_ambiguous=True)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "c:\Python27\lib\site-packages\pwgen\__init__.py", line 72, in pwgen
    passwd = replaceRandomChar(choice(Digits), passwd)
  File "c:\Python27\lib\site-packages\pwgen\__init__.py", line 33, in replaceRan
domChar
    word[pos] = letter
IndexError: list assignment index out of range

Issue persists when numerals=True is removed:

>>> [pwgen(capitalize=True,symbols=True,no_ambiguous=True) for x in range(500)]
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "c:\Python27\lib\site-packages\pwgen\__init__.py", line 70, in pwgen
    passwd = replaceRandomChar(choice(UpperCase), passwd)
  File "c:\Python27\lib\site-packages\pwgen\__init__.py", line 33, in replaceRan
domChar
    word[pos] = letter
IndexError: list assignment index out of range

Python version 2.7.5 on Windows 8.1 x64
pwgen version: 0.4

Support python 3. Currently I get an error with a print statement.

Let's merge in cyberplant/pwgen so we get a nice CLI and republish this as pwgen to PyPi :)

from __future__ import print_fuction
should be
from __future__ import print_function

Lets say I run this with --capitalize and --numerals, and the following line:

passwd = "".join(choice(letters) for x in range(pw_length))

returns the string Abcdefg

The first if if capitalize... passes, but the second if (if numerals...) will cause a random character to be substituted with a numeral.

It's very possible that the character to be substituted is the only capital letter, A, thereby returning a password that doesn't conform to the requirements --capitalize and --numerals.