Using Password Generators

[CTEKAV]

Steve & Leo were talking about using Password Generators.
I have used Steve's Perfect Passwords, but 64 charactors is just to much for all my
Passwords.

https://www.grc.com/passwords.htm

I started using Proton Password Generator (I like & trust Proton products)

Password generator - Create strong, random passwords | Proton

Generate robust, random passwords effortlessly. Our password generator creates strong, secure passwords to safeguard your online accounts

proton.me

I would like to hear from Leo,Steve & others. What is your opinion on using
the PPG?

 

[PHolder]

Any software that uses cryptographically strong random numbers should be easily capable of generating random password strings. Here's a little bit of code I threw together one day during the SN show.

jshell
|  Welcome to JShell -- Version 25.0.2
|  For an introduction type: /help intro

jshell> String makeRandomPassword(int pwLen) {
   ...>     final Random rand = new SecureRandom();
   ...>     final StringBuilder sb = new StringBuilder();
   ...>     final char[] characterPool = "Aa0Bb1Cc2Dd3Ee4Ff5Gg6Hh7Ii8Jj9Kk!Ll@Mm#Nn$Oo%Pp^Qq&Rr*Ss(Tt)Uu-Vv+Ww=Xx.Yy;Zz?".toCharArray();
   ...>     for(int i=0;i<pwLen;i++) {
   ...>         sb.append(characterPool[rand.nextInt(characterPool.length)]);
   ...>     }
   ...>     return sb.toString();
   ...> }
|  created method makeRandomPassword(int)

jshell> IO.println(makeRandomPassword(32));
R^=s%cBzD30e^UE#z!;7gLvSk?dGUwnK

jshell> IO.println(makeRandomPassword(32));
X#RBT@Hq^vdNssaA$XzrE3(t;ZJL5.oZ

jshell> IO.println(makeRandomPassword(32));
cQ6!q.X+U(A%1dUXpq.BVM=7EGH%UI*J

 

[miquelfire]

With Steve's Perfect Passwords, you don't even need to copy the full 64 characters. The times I have used it, I just copied a random substring of the type of password I wanted.

 

[Rocky Beach]

I'd assume Proton Pass's generator is good as would any of the major password manager programs. Use what's easiest - a string of random characters may be difficult to enter into your mobile phone's password manager. Length is key.

 

[CTEKAV]

I don't use a Password Manager, but if I did it would be Proton Pass.
I just used the PPG to change all my passwords with one from PPG.

I just wanted to bring Proton Password Generator to Steve's attention
& get his opinion of it, & other listeners might find it useful. It is in reference to SN-1066.

This is from the SN-1066 Show Notes.

Leo Laporte [01:36:18]:
Uh, what do you recommend? Right. What do you do for entropy in your password generator?

Steve Gibson [01:36:26]:
Um, I've, I've got a, a algorithm that's been running for 10 years or something which uses crypto in order to, to, to roll passwords forward.

I signed up to Steve's GRC Email a long time ago, but he gets tons of Emails
so I gave up mentioning anything in an Email.
I don't need Steve to read my email on SN but I told him about
Protons PG so he & Leo could mention it in a SN episode & give
their opinion.

I only used Perfect Passwords for my Asus RT-AX86U Pro Router.

Proton has a good explanation here...

https://proton.me/blog/what-is-password-entropy

 

[PHolder]

I don't use a Password Manager

You really and truly should. It can save you from phishing because it won't fill a password field on the wrong site where one day you might make that mistake, (You can say you never will, but both Steve and Leo have made this type of mistake, or nearly so.)

 

[Mike.P]

SPP is great, however for personal passwords I use my passwordmanager. For work there are times I need to generate lists of passwords, random strings, and numbers so I like to use the site random.org which provides TRNG.

 

[miquelfire]

I wish I could remember what it was, but I had some random project idea popped into my head that would have me download the pregenrated files from random.org. Sadly, I can't remember what I wanted those random numbers for.

 

[Mike.P]

I guess another option would be to use TRNG hardware, eg one of these :

GitHub - atoponce/awesome-hwrng: A curated table of hardware random number generators

A curated table of hardware random number generators - atoponce/awesome-hwrng

github.com

 

[Sinkaell]

I’ve been mixing generators depending on where the password is going, and shorter strong ones usually do the trick. I’ve leaned on this tool is seamlessly integrated because I like tweaking length and character sets without overkill. The QR option makes it easy to move a password to my phone without typing anything, which saves me from dealing with 60‑character monsters.

 

[PaulH]

I've been using KeePass for Windows for some time now. It has a built-in customizable password generator and auto-type. KeePass doesn't live in the cloud, which has advantages and disadvantages.

 

[JimB]

I don't use a Password Manager, but if I did it would be Proton Pass.
I just used the PPG to change all my passwords with one from PPG.

I just wanted to bring Proton Password Generator to Steve's attention
& get his opinion of it, & other listeners might find it useful. It is in reference to SN-1066.

This is from the SN-1066 Show Notes.

Leo Laporte [01:36:18]:
Uh, what do you recommend? Right. What do you do for entropy in your password generator?

Steve Gibson [01:36:26]:
Um, I've, I've got a, a algorithm that's been running for 10 years or something which uses crypto in order to, to, to roll passwords forward.

I signed up to Steve's GRC Email a long time ago, but he gets tons of Emails
so I gave up mentioning anything in an Email.
I don't need Steve to read my email on SN but I told him about
Protons PG so he & Leo could mention it in a SN episode & give
their opinion.

I only used Perfect Passwords for my Asus RT-AX86U Pro Router.

Proton has a good explanation here...

https://proton.me/blog/what-is-password-entropy

"I just used the PPG to change all my passwords with one from PPG.".
So....are you saying all of your passwords are the same, long random password PPG generated?