Using pwgen creates small passwords #153

New Issue

roxxers · 2021-04-19T12:17:11Z

roxxers commented

2021-04-19 12:17:11 +00:00

@3wordchant I think just moving to a more native solution as a fallback would help portability. As for security, I think the default length when using pwgen is too small. Using something like pwgen 1 32 for a 32 char length is safer. The ones generated for me after the fix were 8 chars long. I'd have to research which method is best but from what I recall, urandom should be fine. Esp when secrets don't need memorisation or ease of typing like passphrases do.

https://git.autonomic.zone/coop-cloud/abra/issues/147#issuecomment-5216 > @3wordchant I think just moving to a more native solution as a fallback would help portability. As for security, I think the default length when using pwgen is too small. Using something like pwgen 1 32 for a 32 char length is safer. The ones generated for me after the fix were 8 chars long. I'd have to research which method is best but from what I recall, urandom should be fine. Esp when secrets don't need memorisation or ease of typing like passphrases do.

decentral1se added the

bug

label 2021-04-20 07:44:08 +00:00

decentral1se added this to the Beta release milestone 2021-04-20 07:44:13 +00:00

decentral1se added the

secrets

label 2021-04-20 07:44:33 +00:00

3wordchant commented

2021-04-20 09:00:41 +00:00

I think the length is fine when abra uses pwgen to auto-generate a token.

The problem crept in because I gave you half-baked instructions to work around #147 -- if you use this instead, you'll get passwords as long as you like:

abra app foo_bar secret generate foo_bar v2 "pwgen -s 40 1"

(The <cmd> argument to secret generate can include arguments..)

I think the length is fine when `abra` uses `pwgen` to auto-generate a token. The problem crept in because I gave you half-baked instructions to work around #147 -- if you use this instead, you'll get passwords as long as you like: abra app foo_bar secret generate foo_bar v2 "pwgen -s 40 1" (The `<cmd>` argument to `secret generate` can include arguments..)

3wordchant closed this issue

2021-04-20 09:00:41 +00:00

3wordchant referenced this issue

2021-04-20 09:04:45 +00:00

Dependency on pwqgen not mentioned in readme #147

This repo is archived. You cannot comment on issues.