[forgottenacc57]

http://www.openwall.com/lists/oss-security/2012/01/17/5

[nerdponx]

I wonder if someone has done a similar analysis of HSXKPasswd. https://github.com/bbusschots/hsxkpasswd

[falcolas]

Note the "pronounceable" caveat in the original message. Still important to note, but the implementation above is not at risk.

[corndoge]

mind the options

http://www.openwall.com/lists/john-users/2010/12/07/3