Warning: Stop trusting "AI" password generators so much

I read a blog post from a researcher at MIT last week who tested 12 of those AI password apps and found 4 of them reused the same "random" strings across different accounts. I know people love the convenience but honestly... I'd rather make up my own nonsense passwords and store them in a notebook taped under my desk. Has anyone else looked into whether these apps are actually random or just faking it?

2 comments

2 Comments

paige_west1mo ago

Actually looked into this deeper after @ray_carr's point about the identical strings - turns out a lot of those apps aren't using proper entropy at all. Some of them pull from a tiny dictionary of like 10,000 phrases they generated once and just rotate through them (which explains the duplicates). The MIT post did mention that only 3 of the 12 apps used mouse movement or keyboard timing as a seed, the rest just relied on basic math randomizers you'd find in a JavaScript tutorial. For the ones that claimed "quantum randomness", two of them were just appending random numbers to the same base set of 50 words over and over.

ray_carr1mo ago

The MIT research you mentioned... did they actually crack open the code to see how these generators pick their strings? I've always wondered if they just pull from a small pool of pre-set phrases instead of true randomness. A buddy of mine had two different AI password apps spit out the exact same 16-character combo last month, which is way too suspicious for coincidence. That notebook under your desk might be old school but at least it's not leaking your data to some server farm. Did the blog post say whether the apps were even using proper entropy sources like mouse movements or system timestamps?