Hacker News Reader

Comment by robinhood | Hacker News Reader

So.

The tool is now 100% front-end. I used the library @mykii posted below (https://github.com/mykiimike/jen) and there should not be any HTTPS errors now.

The code is even on Github (https://github.com/djaiss/simplestpasswordgenerator) - so you can see that I don't do anything nasty with our precious passwords.

View on HN

Hey one thing about your website It could be nice if you can add a "Hardening" button. On clicking you can set to true/false hdl.hardening(bool) in order to get very specials chars. cheers

> Math.random()

That's just not acceptable, even as a fallback, I'm sorry, the whole idea of this service is just horrible. Please don't use this.

I talking about failsafe not fallback, U will never reach the condition on browsers or nodejs. This mimic is there just to avoid a null return from .password() (generaly not checked by user) which could be more dangerous.

Right because completely aborting would break things, who cares about security?

This is just horrible and I honestly hope nobody will ever use this, I'm sorry.

One more thing, all lib/codes i can find on the net use Math.random() that's why i made this lib. because i use it first :)

Lol.

I'm curious, why is Math.random() not OK? Does it have a bad seed?

http://ifsec.blogspot.fr/2012/05/cross-domain-mathrandom-pre...

awesome and scary at the same time. awescary. If I understood it correctly this should work for nodejs servers as well, for example when they create random ids for users or urls.

except that nodejs generally uses crypto.randomBytes() and the Google V8 seems to have a strongest Math.random() but the approach is not clear

thanks

Reply on news.ycombinator.com