Post #3257596

2026-05-28 16:17 UTC

@linuxandyarn@hachyderm.io @unlambda@hachyderm.io @dramforever@mastodon.social Without doing a full audit, the top 5 results on DDG for "password generator" look local, judging by latency (checking on phone, too lazy to pull up DevTools on a PC and check properly). It really is irresponsible to implement a password generator site in any other way.

Replies (1)

@unlambda@hachyderm.io 2026-05-28 16:34

@lina@vt.social @linuxandyarn@hachyderm.io @dramforever@mastodon.social I think I found the source for the DDG password generator here: https://github.com/duckduckgo/zeroclickinfo-goodies/blob/master/lib/DDG/Goodie/Password.pm Most of these instant answers on DDG seem to be contributed via this (now shut down) open source program. The password generation itself is... OK. It uses the slightly biased modulo for randomly picking characters, but I checked and so does `pwgen`; for generating passwords where you're not trying to optimize for things like readability/easiness to type and not strictly controlling the entropy, that's not terrible. It does use urandom for its entropy source which is likely the best option. But yeah, just doing this server side is a terrible idea. It could be logged, it could be cached. It doesn't appear that it's cached, it gives me a new one every time, but who's to say they won't at some point say "these instant answers are taking up too much CPU, let's add a cache in front of them" and then a bunch of people get the same password.

Open ##3257597