implement password generation about ots HOT 2 CLOSED

Hey Luzifer,

thanks for your tips, learnt something new! Looks like I'll remove the password generator from my instance and search for a better option.

from ots.

As a first remark:

password += characterSet.charAt(Math.floor(Math.random() * characterSet.length))

Please NEVER use Math.random() for secure purposes! That random number generator is NOT cryptographically secure!

In regards of adding a password generator to OTS: I think there are way better tools (i.e. passwd.fyi using Luzifer/password, Keepass*, Bitwarden, …) to generate passwords (for example have a look at the list of checks my tool applies to the generated password to ensure "dict"-attacks are pointless).

OTS is intended to share secrets (passwords, steam-keys, text, …) in a secure way. Following the Unix philosophy - especially sentence one

Make each program do one thing well. To do a new job, build afresh rather than complicate old programs by adding new "features".

we should not add features out of this scope.

In the end within OTS a password generator already exist but only for use as a source for the encryption key and with a much more limited character set. Sure we could expose that generator to fill the secret on its own but this would add even more buttons to the interface and more complexity to the tool.

In regards of the Unix philosophy and the KISS principle ("keep it stupidly simple" - which we already stretched a lot) lets not add this.

from ots.