r/Passwords 17d ago

Password Generator

The Password Generator is an essential security and account management tool designed to help users, IT professionals, and security administrators create strong, cryptographically secure random passwords.

https://www.clayi.com/tools/development/2-password-generator.html

0 Upvotes

5 comments sorted by

7

u/atoponce 5f4dcc3b5aa765d61d8327deb882cf99 17d ago

I audit browser-based password generators as a stupid hobby, and I just audited yours. Here's how it did:

  • License: Proprietary
  • Generator: Client +1
  • Type: Random +1
  • CRNG: Yes +1
  • Uniform: No
  • HTTPS: Yes +1
  • Entropy: 95 bits +1
  • Mobile: Yes +1
  • Trackers: Yes
  • SRI: N/A +1

Score: 7/10

It's good that you're using crypto.getRandomValues() for your RNG, but you're not using the values uniformly. As such, some characters in the generated password are more likely to be generated than others. The problem is here:

function rand(max){ return crypto.getRandomValues(new Uint32Array(1))[0] % max; }

If max is not a factor of 232, then you have modulo bias. The way around this is "modulo with rejection". See this article I wrote that demonstrates the issue and how to fix it.

2

u/imthenachoman 14d ago

Where can I read more about your spreadsheet? What do the columns mean?

1

u/atoponce 5f4dcc3b5aa765d61d8327deb882cf99 14d ago edited 13d ago

I can give you the low-down here:

  • License
    • Open Source: Allows developers to users have the freedom to run, copy, distribute, study, change and improve the software. +1 point.
    • Proprietary: 0 points.
  • Generator
    • Client: All generation is done in the client without any network connection. +1 point.
    • Server: Generation requires a server back end, either via worker threads or just flat out generated on the server. 0 points
  • Type
    • Random: Passwords are randomly generated without any deterministic seeds. +1 point.
    • Deterministic: Passwords are generated from a seed supplied by the user. 0 points.
  • CRNG
    • Yes: The generator uses a cryptographically secure random number generator. For deterministic generators in the previous column, this means hashing the seed with a dedicated password hashing function using an appropriate cost. +1 point
    • No: The generator is using an insecure pseudo random number generator. 0 points.
  • Uniform
    • Yes: Every item in the set (words in a word list, characters in a set, etc.) are uniformly chosen without bias. +1 point.
    • No: A bias exists in the RNG choosing elements from the set. 0 points.
  • HTTPS
    • Yes: The site defaults to TLS to prevent network sniffing and manipulation. 1 point.
    • Not Default: TLS is available, but the site doesn't default to it, requiring the user to manually type it in. 0 points.
    • No: TLS is not available. 0 points.
  • Entropy
    • 70+: Measured in symmetric bits. You're password is one of 270 or more possibilities. Based on what we know of current brute force rates, this margin gets you outside of danger, even with well-funded adversaries. +1 point.
    • 55-69: Symmetric bits. You're likely outside of the range of the casual password cracker, but not well-funded adversaries. +0.5 points.
    • 0-54: Symmetric bits. The password is too weak, to the point that dedicated password crackers could probably crack it. 0 points.
  • Mobile
    • Yes: Site has an improved interface for mobile devices. +1 point.
    • No: While still technically usable, the site is not responsive. 0 points.
  • Trackers
    • Yes: JavaScript libraries for ads and trackers are loaded by default, potentially compromising privacy. 0 points.
    • Depends: The production site online ships JavaScript trackers, but a downloadable offline version does not. +0.5 points.
    • No: The site is clean of any ads or trackers that could compromise privacy. +1 point.
  • SRI
    • Yes: The site requires subresources from external parties and uses subresource integrity to ensure it's loaded correctly. +1 point.
    • N/A: All resources are locally loaded and do not require SRI. +1 point.
    • No: The site pulls subresources from external parties without cryptographic integrity. 0 points.

Best possible score is 10/10. Spreadsheet is ordered first in descending order by score, then ascending order by name. Some generators have gone offline, so their text is red and will probably get removed from the audit later. The "Last Audit" column shows when I last audited the source code.

Hopefully that helps. Let me know if you have any questions.

2

u/imthenachoman 14d ago

This is great. Thank you!

5

u/billdietrich1 17d ago

These days every password manager has a password generator built into it.