pass generates very weak passwords with busybox's tr

[Allan Odgaard]

On 16 Jul 2019, at 21:09, Daniel Janus wrote:

> Clearly, Busybox's `tr` doesn't support the `[:graph:]` character
> class. Instead, it's taking those 9 characters (8 distinct) as a
> character set.

This gave me a chuckle :)

> Given that Busybox's focus is on size and essential features, and
> character classes are arguably not essential, I doubt whether this
> will be changed upstream.

I checked the source¹ and they have two commented constants: 
`CLASS_graph` and `CLASS_print`.

I think that it’s just that nobody got around to adding support for 
these. It would hardly increase the size.

Btw: Since they support both `alnum` and `punct`, I think you can use 
this:

     read -r -n 12 pass < <(LC_ALL=C tr -dc '[:punct:][:alnum:]' < 
/dev/urandom); echo $pass

Maybe submit a PR and see what Jason says.

But I think it would be better to submit a PR toward BusyBox’s `tr` 
implementation.

¹ https://git.busybox.net/busybox/tree/coreutils/tr.c
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.zx2c4.com/pipermail/password-store/attachments/20190716/bee54504/attachment-0001.html>