0

I'm looking for an app (used on laptop) to generate long, securely random, 1-use passwords that are impossible to be memorized.

It must be "offline" or at least openly verifiably sandboxed from a possibly malicious server.

The random seed must be cryptographically secure.

It's best if it allows an additional option for "variable user input" for modifying the random seed, eg via keyboard/mouse etc.

It's best if it's not from US/UK/Canada, but if so, it's best there is proper evidence that there is no FBI backdoor.

|improve this question
  • Would simply generating a hash from a random source of data work? On a *nix system - dd if=/dev/random bs=1 count=100 | md5sum or similar ... – ivanivan Feb 8 '18 at 13:10
  • @ivanivan, That would be a great stopgap if it would work, but I'm on a Mac. – Pacerier Feb 17 '18 at 17:43
  • Mac? Open the Terminal.app thingie and it will work. In fact, lemme get you a good answer typed in – ivanivan Feb 17 '18 at 18:28
1

OK, since you are on a Mac, you can take advantage of that under the hood Unix goodness.

All *nix systems provide /dev/random, or possibly /dev/urandom or /dev/arandom. These provide random data base on noise generated by device drivers, OS function calls, all sorts of stuff to provide true randomness.

So, what you can do to generate random stuff suitable for password use is a little command line magic. Open the Terminal.app thingie, and at the prompt something like

dd if=/dev/random bs=1 count=100 | openssl sha -sha256

This should give you output like

$ dd if=/dev/random bs=1 count=100 | openssl sha -sha256
100+0 records in
100+0 records out
100 bytes copied, 0.000293454 s, 341 kB/s
(stdin)= f4a5f44ee7351ba4d1f2ca7a7722ae79c0cbbb5e3ab4e9b60ddcfa92368e6ff1

and that nice long string can be used as a password.

What is this doing? It is grabbing 100 random bytes of data provided by /dev/random and instead of outputting to a file or the screen the output is piped to be the input for the openssl command.

Feel free to use more/less bytes of random data. In fact, if just having a nice long random string works for your purposes you could get the SHA256 hash of files on your system, etc.

|improve this answer
  • Nice, I'd take this as a stopgap until a better one comes along if any. initially I was thinking along the lines of something like a UI (javascript) page that takes optional mouse/key input. ¶ Btw, is there a cmd for "SHA256 of last modified file on the filesystem"? – Pacerier Feb 18 '18 at 1:07
  • @Pacerier sure, just a little more shell scripting magic, using find, sort and either head or tail (depending on sort order) - but it will be disk intensive and take time. Not sure of what "notify" or "dialog" type utils there are on OS X, in Linux we have wrappers to provide a gui for shell scripts (zenity, etc). Not sure if you'd be better asking at unix.stack or over on askdifferent ... – ivanivan Feb 18 '18 at 3:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.