<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class=""><div class="gmail_default" style="font-family:"times new roman",serif;font-size:large">Yes, change the password.<br class=""> Are there better tools than apg.<br class=""> <span style="font-weight:bold;color:rgb(95,99,104);font-family:Roboto,arial,sans-serif;font-size:14px" class="">apg</span><span style="color:rgb(77,81,86);font-family:Roboto,arial,sans-serif;font-size:14px" class=""> "generates several random passwords. It uses several password generation algorithms (currently two)"<br class=""> If you suspect generated passwords are guessable, grab some physical dice to chop generated passwords into 1-6 char chunks.</span></div></div></div></div></blockquote></div>This is the first I've seen of apg.<div class=""><br class=""></div><div class="">MacOS keychain will generate passwords of different forms for you. Up until recently, it could generate "memorable" passwords, which consisted of a dictionary word, a number, a special character, and another dictionary word. While not necessarily really memorable, these did have the advantage of being easy to type - important if you have to transfer one from one system to another, especially to a phone where typing is a pain. And if you use one of these with any regularity it does end up being fairly easy to remember.</div><div class=""><br class=""></div><div class="">I guess they decided this form of password had become too risky, as it's been eliminated from recent versions of Keychain. I wrote a program to do the same thing, with a couple of variations for somewhat increased security: Two words from a dictionary of 49415 (all lower case) words. Either, both, or neither is randomly capitalized. One integer from 1 to 9999. Combine with equal probability as either word||number||special||word or word|special||number||word. All told, just under 1e14 possible outputs. Yes, it could be brute-forced - anything most people could memorize and type could be - but for most purposes it's pretty good - certainly better than a human could come up with unaided. Here a some outputs:</div><div class=""><br class=""></div><div class="">Emailing{9737Xxii<br class="">Uprising!7101Youre<br class="">alas6931`Vegeta<br class="">revamped931>Ecliptic<br class="">Caused/6960Heatwave</div><div class=""><br class=""></div><div class="">Some of the "words" in the list are ... strange.</div><div class=""><br class=""></div><div class="">At the moment its implemented as two shell scripts - one creates strong random numbers using /dev/random - but relying on a couple of little C tools of my own, so not readily distributable. I may get 'round to turning it into something more broadly usable.</div><div class=""><div class=""> -- Jerry</div></div><div class=""><br class=""></div></body></html>