Post #3257597

@lina@vt.social @linuxandyarn@hachyderm.io @dramforever@mastodon.social I think I found the source for the DDG password generator here: https://github.com/duckduckgo/zeroclickinfo-goodies/blob/master/lib/DDG/Goodie/Password.pm Most of these instant answers on DDG seem to be contributed via this (now shut down) open source program. The password generation itself is... OK. It uses the slightly biased modulo for randomly picking characters, but I checked and so does `pwgen`; for generating passwords where you're not trying to optimize for things like readability/easiness to type and not strictly controlling the entropy, that's not terrible. It does use urandom for its entropy source which is likely the best option. But yeah, just doing this server side is a terrible idea. It could be logged, it could be cached. It doesn't appear that it's cached, it gives me a new one every time, but who's to say they won't at some point say "these instant answers are taking up too much CPU, let's add a cache in front of them" and then a bunch of people get the same password.