tytso / pwgen Goto Github PK

It would be great if the user could request passphrases to be generates based on the Diceware and the EFF wordlist.

There is no mention on this project's former homepage, https://sourceforge.net/projects/pwgen/, that the project has moved here to GitHub. Please add such indication there.

I noticed the option -c (--capitalize) is not always honored in the output.

Here is as sample output:

pwgen -B --capitalize -y -n 10 20
Et&eeL3iet juPh+ie9Fu xoo%Piepi3 zo7vey*u7M bee"thah4o Nie7oothe^ peeb]i7fah
kaew7Jizu Uw+ee9naix Aito#Yie4a uphu;sa4La va4Cae:the hob~ai9Thu wiePae9Hu: ohm;oh9dee Egae\F4iet Pheeth3oe cie4wieJe( ueg7Pic-oh um4ciodi:e

in this run, 4 results do not have a capital letter.

This is frequently seen, almost every time.
My setup is: Debian Linux 10 (buster)
pwgen version: 2.08-1

See the example below

$ pwgen -n 2 1
Rh
$ brew info pwgen|head -n 1
pwgen: stable 2.08 (bottled)

Backslashes are historically hard to handle, and if you have several layers that de-escape, you might need to express them with powers-of-two amounts of backslashes.

pw_random_number(max_num) simply performs a modulo of a random integer against the number of elements in the character array. Since there is no check whether the maximum integer value is divisible by the number of elements in the character array, modulo bias is introduced. This would need to be fixed before the command is used to generate passwords for a high security environment.

According to the password table published by hive systems, even the most secure 8 character passwords generated by this tool are now crackable within 5 minutes.

The link above explains how they came up with the table. Since the password table changes every year, I would like to include the table as it stands this year (2023) into this issue.

I think we can no longer adhere to the nist recommendation of 8 character passwords.

The NIST document linked to above was updated to include the

Removal of pre-registered knowledge tokens (authenticators), with the recognition that they are special cases of (often very weak) passwords.

Since passwords are still very much in use, I am raising this issue so that we can consider moving the default length of the passwords generated by pwgen to 12 instead of 8.

As the development of haveged, the amount of seed in /dev/random has increased a lot. As a result, it can improve the security of password when use /dev/random as random source.

Examples include : and ;, , and ., backtick and ', etc.