183
this post was submitted on 14 Sep 2023
183 points (97.9% liked)
Ask Lemmy
26858 readers
1837 users here now
A Fediverse community for open-ended, thought provoking questions
Please don't post about US Politics. If you need to do this, try !politicaldiscussion@lemmy.world
Rules: (interactive)
1) Be nice and; have fun
Doxxing, trolling, sealioning, racism, and toxicity are not welcomed in AskLemmy. Remember what your mother said: if you can't say something nice, don't say anything at all. In addition, the site-wide Lemmy.world terms of service also apply here. Please familiarize yourself with them
2) All posts must end with a '?'
This is sort of like Jeopardy. Please phrase all post titles in the form of a proper question ending with ?
3) No spam
Please do not flood the community with nonsense. Actual suspected spammers will be banned on site. No astroturfing.
4) NSFW is okay, within reason
Just remember to tag posts with either a content warning or a [NSFW] tag. Overtly sexual posts are not allowed, please direct them to either !asklemmyafterdark@lemmy.world or !asklemmynsfw@lemmynsfw.com.
NSFW comments should be restricted to posts tagged [NSFW].
5) This is not a support community.
It is not a place for 'how do I?', type questions.
If you have any questions regarding the site itself or would like to report a community, please direct them to Lemmy.world Support or email info@lemmy.world. For other questions check our partnered communities list, or use the search function.
Reminder: The terms of service apply here too.
Partnered Communities:
Logo design credit goes to: tubbadu
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Just don't be that guy that uses a website to generate passwords. If you're going to generate passwords it needs to be a trusted utility that runs locally otherwise someone has your password.
If the website generating the password a) doesn't know the site/account and b) doesn't know the username then it doesn't matter. And c) with 2fa knowing a password doesn't grant access by itself.
If a site is decently coded, it would be run in client side scripting like JavaScript anyway. It wouldn't require anything being sent to the site.
This is the crux of the issue. The average internet user, the kind of user going to a random website to generate a password, would not be able to find this out. For all we know, even without the username, a randomly generated password could be saved to a wordlist after it's generated. That would be pretty smart, since now you have a list of known used passwords that someone went through the effort to generate to secure something more valuable. (Which would refute your points A and B)
And your point C, not always. By your same logic, you'd be comfortable using "password" as long as you have 2FA? There is always a possibility of 2FA being bypassed through some other vulnerability depending on its implementation. This is why it's TWO (or multi) factor authentication. In case one factor is compromised, you have another layer of defense. If you use a compromised password (by either using "password" or a sketchy password generator), then you've effectively reverted yourself back to one factor authentication. Or zero, if you didn't have MFA.
Don't listen to anyone suggesting otherwise. Don't use random websites. Either stick to a password manager to generate them for you, or take it completely offline with a dice roll-based generation.
I've been using Pass since not long after it was released. Moved my OTPs into it as well.