2

Given the plethora of random password generators (RPG) available, I'd like to do some black box testing on some.

Let's take https://passwordsgenerator.net/ for example. Assuming the whole generator is a black box with 0 information about how the passwords are generated (can't even view the .js stuff), and all we have is a "Generate password" button that somehow outputs a seemingly random password each time it's clicked.

We do NOT know:

  • Who made or hosts the RPG
  • What algorithms are used to generate the password
  • How they get the randomness (Atomic decay? Lava lamps? Monkeys on type writers? People trying to exit Vim?)
  • Source code.

What we know:

  • If you click "Generate password", you get a seemingly random password

We can get thousands or millions of passwords as testing data. Given just those passwords, can we analyze them to figure out (even just estimate) how cryptographically secured the RPG is?

(I'm not looking for processes enough to generate whole reports and research papers. I'm just thinking of a way the common people can do a "quick" and rough test on the RPGs, maybe to choose between the common RPGs)

5
  • 1
    There is no need for a password generator to be cryptographically secure in the first place since passwords are not used as direct input into cryptographic operations. Please explain where your requirement comes from. Apart from that: even if this generator where cryptographically secure the site could just store all passwords generated and use it as a dictionary when trying to break some site. Simply don't let some internet site generate passwords for you. – Steffen Ullrich Jan 5 '20 at 10:43
  • I'm not thinking about just the online RPGs. I'm curious about ways to test the security of random password generators in general, given just the output (passwords) and nothing else. – John Zhau Jan 5 '20 at 13:27
  • 1
    Again, the requirements for security in the context of passwords are not being cryptographically secure. – Steffen Ullrich Jan 5 '20 at 14:20
  • I'm not asking this to look for some cryptographically secured RPGs. I'm only interested in determining how cryptographically secured an RPG likely is using just the outputted passwords and nothing else. – John Zhau Jan 6 '20 at 4:49
  • Yes, you are asking for "how much of irrelevant property" it has and not "if it has irrelevant property". Still, its an irrelevant property for a password generator. It is like asking "how much red" is a car if you are actually interested in how fast you can drive with it. – Steffen Ullrich Jan 6 '20 at 7:21
2

It is very hard to evaluate the quality of a random password generator without knowing its underlying algorithms. The quality (the entropy) depends essentially on 2 elements:

  • the number of possible combinations
  • the equivalence of probability of different combinations

The problem is that a random generator that would iterate over 10 millions random password phrases will be a very poor password generator if the attacker could know the used passphrases. But if you only use several thousands of generated passwords it will look very good.

If you really know nothing, you can do little more than testing a rather large sample for collisions: if at least one password occurs more than once, chances are that the generator has a low entropy. But unless you can test for very large samples (the magnitude order of the expected entropy) no collision is not a sufficient proof of quality.

So my advice is: if you do not know enough from the generator, just do not use it.

0

On 64-bit machines the maximum integer value is 0x7fffffffffffffff (9,223,372,036,854,775,807), and in a random number generator which is not cryptographically secure the seed value will typically be an integer in this range starting from 0, so it should be clear given this number of examples in a very simple generator that patterns could be spotted. You could also perform an attack which would require the server to be reset, potentially resetting the seed and comparing values generated. Essentially though techniques for randomness are a fairly well defined branch of statistics and a good example can be found e.g. here: https://csrc.nist.gov/publications/detail/sp/800-22/rev-1a/final

0

First off, no password generator on a website "secure" in any sense - unless you read the source code and host it yourself.

Second, the only requirement for a password is that it is sufficiently random.

You could perform statistical tests for randomness, but that would require some knowledge about the composition rules to be meaningful (e.g. does it always have a special character? Is it diceware with English words?).

And even if your test finds the result to be statistically random, it will not mean that it is secure, as you will not know the seed (or state) of the generator at the time when you generate the "real" password.

To sum it up: There is no test that laypeople could use to "vet" a password generator.

The correct way to generate passwords is to use a password manager that you trust. Not to create passwords on websites or download and run random software from the internet.

If you think you can still live without a password manager in this age and day: Use diceware. It is demonstrably secure and truly random.

9
  • Surely your first paragraph negates your penultimate one? Especially as many password managers are closed-source – LTPCGO Jan 6 '20 at 9:01
  • @LTPCGO MechMK1 says: Mostly false. [1],[2],[3] – MechMK1 Jan 6 '20 at 13:22
  • @MechMk1 not really false, I said 'many' not most and you took a very small sample. This article provides a good number and the comparison between both: proprivacy.com/password-manager/guides/… – LTPCGO Jan 6 '20 at 13:32
  • @LTPCGO That doesn't factor in popularity though. If 99% of users used an open-source password manager, and 10,000 password managers existed that were closed-source, then making the argument "Many password managers are closed-source" is "technically true", just as it is technically true that we share some DNA with bananas. – MechMK1 Jan 6 '20 at 13:56
  • But...the point is that many of them are closed source. – LTPCGO Jan 6 '20 at 14:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.