When you reject a random password, you introduce a bias. When you select based on your idea of what's random, it's akin to selecting based on anything else. It defeats the security purpose of an RNG. So one ought to be careful with this.<br><div class="gmail_quote"><div dir="ltr">On Thu, May 4, 2017 at 10:41 Jonathan Proulx <<a href="mailto:jon@csail.mit.edu">jon@csail.mit.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Thu, May 04, 2017 at 03:16:31PM +0200, Jason A. Donenfeld wrote:<br>
:There is a non-zero probability that a RNG will output the complete works<br>
:of Shakespeare.<br>
<br>
and a non zero chance that it will generate "password1234" that<br>
doesn't mean accepting that is a good idea though, one also has to<br>
consider likely attack strategies.<br>
<br>
the example given is likely fine, but if you randomly get a password<br>
that you think is bad, regeneration is always an option.<br>
<br>
-Jon<br>
<br>
:<br>
:--<br>
:Sent from my telephone.<br>
:<br>
:On May 4, 2017 13:56, "Matthieu Weber" <<a href="mailto:mweber@free.fr" target="_blank">mweber@free.fr</a>> wrote:<br>
:<br>
:On Thu 04.05.2017 at 09:35:24PM +1000, Jens Tröger wrote:<br>
:> I know that passwords are generated by pwgen, which is considered a<br>
:> strong generator (right?) but today it produced a password with<br>
:> consecutive repetitions: #9d:$_r{""yww4{k?}.i'^P}z<br>
:<br>
:Randomness sometimes generates repetition. If you want to filter out the<br>
:passwords with repetitions, you are effectively reducing the number of<br>
:possible passwords, therefore making it (slightly) easier to crack.<br>
:<br>
:> Not sure if this is an issue per se? Can I ignore this in the future?<br>
:<br>
:I would say it's not an issue, especially with this long a password as<br>
:the one above.<br>
:<br>
:Matthieu<br>
:--<br>
: (~._.~) Matthieu Weber - <a href="mailto:matthieu@weber.fi.eu.org" target="_blank">matthieu@weber.fi.eu.org</a> (~._.~)<br>
: ( ? ) <a href="https://weber.fi.eu.org/" rel="noreferrer" target="_blank">https://weber.fi.eu.org/</a> ( ? )<br>
: ()- -() public key id : 0x85CB340EFCD5E0B3 ()- -()<br>
: (_)-(_) "Humor ist, wenn man trotzdem lacht (Otto J. Bierbaum)" (_)-(_)<br>
:<br>
:_______________________________________________<br>
:Password-Store mailing list<br>
:<a href="mailto:Password-Store@lists.zx2c4.com" target="_blank">Password-Store@lists.zx2c4.com</a><br>
:<a href="https://lists.zx2c4.com/mailman/listinfo/password-store" rel="noreferrer" target="_blank">https://lists.zx2c4.com/mailman/listinfo/password-store</a><br>
<br>
:_______________________________________________<br>
:Password-Store mailing list<br>
:<a href="mailto:Password-Store@lists.zx2c4.com" target="_blank">Password-Store@lists.zx2c4.com</a><br>
:<a href="https://lists.zx2c4.com/mailman/listinfo/password-store" rel="noreferrer" target="_blank">https://lists.zx2c4.com/mailman/listinfo/password-store</a><br>
<br>
<br>
--<br>
_______________________________________________<br>
Password-Store mailing list<br>
<a href="mailto:Password-Store@lists.zx2c4.com" target="_blank">Password-Store@lists.zx2c4.com</a><br>
<a href="https://lists.zx2c4.com/mailman/listinfo/password-store" rel="noreferrer" target="_blank">https://lists.zx2c4.com/mailman/listinfo/password-store</a><br>
</blockquote></div>