Hacker News new | ask | show | jobs
by G3E9 3263 days ago
Ahh, ok then how about using the DateTime at runtime? That would then save you from having to keep "n" stored elsewhere for future uses.

Edit: nevermind, this would prevent you from retrieving the password - I had in mind a password generator, sorry.

1 comments

By the way it's generally not a good idea to use dates in password generation or for random seeds. An attacker who has any information about the approximate time you generated the password (e.g. minutes before registering for a site) would be able to iterate over those several thousand seconds.

For consumer use cases, you should use sources of noise for this, such as microphone noise, mouse movements, fluctuating voltages, etc. If you wanted to be super-secure you would use a quantum random number generator, which is truly random, but unnecessary for the threat models of most consumer uses. Just use anything but date/time. The random number generators of most modern languages and operating systems already have such measures in place.