Post #3257592

2026-05-28 14:43 UTC

@lina@vt.social @dramforever@mastodon.social Maybe I'm not sure why you're putting server-side in bold. I'm talking about creating unique passwords for random sites, and I expect DDG to have more entropy than the one you mentioned. Generating locally with `pwgen -sy` is best, but if someone does need an online generator, then yes, I'd trust DDG more than most.

Replies (1)

@unlambda@hachyderm.io 2026-05-28 15:36

@linuxandyarn@hachyderm.io @lina@vt.social @dramforever@mastodon.social The more people a secret is shared with, the less secret it is. A DDG based password generator is at least shared with DDG. It's also done via some kind of pugin system they have? It says: This Instant Answer was made by the DuckDuckHack Community. Developer: cinlloc Developer: mintsoft But this DuckDuckHack program was shut down nearly a decade ago. Was this particular plugin system developed for secure generation? Or are they logging every one of the "answers" produced by it somewhere? What happens if those logs are compromised, or law enforcement does an overly broad request for information that pulls all of these logs? And since this whole DuckDuckHack instant answers submission system seems to have shut down, there aren't any docs available online for it any more, you have to dig through the internet archives to even find docs on how it worked. Is any of this even maintained?

Open ##3257593