4

Do you consider PWGen safe enough to use? What do you use to make truly random password. PWGen should be using "movement of your mouse" to make it really random, right?

1
  • I am worried about 1) Randomnes. Is this seeding "random enough"? 2) Backdoors. I know PWGen is open source, but... Can I trust it? Has it been reviewed?
    – user104674
    Mar 17, 2016 at 15:13

1 Answer 1

8

The pwgen is a password generator developed by Theodore Ts'o, that is same person who create the /dev/random, and /dev/urandom for the Linux kernel.

randomness

pwgen will seed from /dev/urandom, or /dev/random if they are available on your system. See randnum.c. I don't have refs, but I am very confident that /dev/*random has been reviewed for security problems. Since it is critical too, and used by almost every cypto program on a typical linux system.

Backdoors

The source code for pwgen is really pretty small. I am not a security researcher by training, or trade, but I just can't see anywhere that you could hide anything like a backdoor, in a utility that simply returns a string of random random characters or phonemes. There is no network access, there no writing to the filesystem that I see. But feel free to look for yourself source.

password strength.

I suspect the if an attacker knew you had used pwgen, and knew which options you used, and knew you used one of the options with the phonemes, then they might be able to brute force your password faster than if they attacker assumed your password that was completely random. But that is true for most methods for generating passwords that people can actually remember. Generating longer pwgen passwords should compensate.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .