Simplest Password Generator
Security and privacy
password generator
SHOW HN2015
How HN took it
2 positive, 6 neutral or asking, 3 mixed, 8 critical, out of 19 comments about the project. Thread score -0.27.
Privacy: 0 for, 3 againstIdea: 1 for, 2 againstExecution: 0 for, 2 againstDesign: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Nice simple, clean design
From 3 comments
first point is enough to kill this and similar services for all times. Nice simple UI though. :)
Vespasian on HNI really liked the design, and since it is done only in front end right now, I also liked the idea. It may not be suitable or the perfect solution for hackers like in this…
tugberkk on HNI've been using http://makemypassword.com for a few years. The Copy my Password button copies the generated password to your clipboard instead of using a keyboard combo.
nascro on HN
Objections
Passwords were generated server-side, so generated passwords could be stored or intercepted
From 3 comments
A few issues: - password generated server-side (why?) - mixed http/https content - no info on how the password is generated
agd on HNI like your tool from a UX point of view, but nothing can fix the security issue that you use passwords created on a website which could at any time choose to store them. PAAS…
Vespasian on HNMaybe generate the passwords client-side instead of server-side?
gotoSander on HN
Math.random() is not cryptographically secure
From 2 comments
> Math.random() That's just not acceptable, even as a fallback, I'm sorry, the whole idea of this service is just horrible. Please don't use this.
lawl on HNhttp://ifsec.blogspot.fr/2012/05/cross-domain-mathrandom-prediction.html
mykii on HN
Generated passwords lack special characters, reducing entropy
From 1 comment
Quick question, it seems that the generated passwords never make use of special characters (only digits and letters). I feel that it restricts their entropy, doesn't it? I am not…
VeejayRampay on HN
Requests
Generate passwords client-side in the browser
From 3 comments
Maybe generate the passwords client-side instead of server-side?
gotoSander on HNI like the colors. Most browsers these days implement window.crypto.getRandomValues() so you could use that and do the generation client-side in Javascript. That way, I don't…
brianhempel on HNWhy is it telling me to press Command+C to copy the password on my Linux machine? Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0 And yes, anybody who would…
phs2501 on HN
Use crypto.getRandomValues instead of Math.random
From 2 comments
I like the colors. Most browsers these days implement window.crypto.getRandomValues() so you could use that and do the generation client-side in Javascript. That way, I don't…
brianhempel on HN> Math.random() That's just not acceptable, even as a fallback, I'm sorry, the whole idea of this service is just horrible. Please don't use this.
lawl on HN
Add a hardening option for special characters
From 1 comment
Hey one thing about your website It could be nice if you can add a "Hardening" button. On clicking you can set to true/false hdl.hardening(bool) in order to get very specials…
mykii on HN
Questions
Does the service store generated passwords?
From 2 comments
I've always wondered if these services store the passwords...
kolev on HNI like the colors. Most browsers these days implement window.crypto.getRandomValues() so you could use that and do the generation client-side in Javascript. That way, I don't…
brianhempel on HN
Why is the password generated server-side?
From 1 comment
A few issues: - password generated server-side (why?) - mixed http/https content - no info on how the password is generated
agd on HN
Alternatives named
pwgen command-line tool
From 1 comment
Sorry, to be an asshole, but I'll use pwgen[0] over some website that gives me a password everyday. Even if it's client side only it's still a bad idea. [0]:…
lawl on HN
Shell one-liners using /dev/random or /dev/urandom
From 2 comments
Why would I go to a website to make a password when I could avoid leaving my terminal? alias mkpass='head -c 9 /dev/random | base64'
AndyKelley on HNeasy bash version:: function password(){ cat /dev/urandom | base64| tr -dc 'a-zA-Z0-9' | fold -w ${1:-20} | head -n 1 }
siliconc0w on HN
makemypassword.com
From 1 comment
I've been using http://makemypassword.com for a few years. The Copy my Password button copies the generated password to your clipboard instead of using a keyboard combo.
nascro on HN