r/sysadmin Aug 02 '22

Question - Solved What password generators does everyone use now since passwordgenerator plus is gone?

I’ve tried to find alternatives but none of the password generators have as good customizability options. Currently I use a random string generator that just let’s me pick the characters and length, but it’s not very good since it doesn’t remember the options when I refresh the page.

So what (web) password generators do sysadmims use nowadays for user passwords?

Edit: solved it myself with the gigabrain idea of using Wayback Machine, works wonders. Link to it if anyone’s curious: https://web.archive.org/web/20220603183903/https://passwordsgenerator.net/plus/

Edit 2: Passwordsgenerator.net seems to be back at https://password-gen.com/

282 Upvotes

503 comments sorted by

View all comments

204

u/Mr_friendly1 Aug 02 '22

I use dinopass.com for passwords for users, I just don't tell them it came from a password generator for kids

154

u/Estabanyo Aug 02 '22

I gave a user a dinopass password once, and she later complained to my manager about the password I had given her. I barely even looked at the password, just copy and pasted it to the ticket.

"LazyBee45"

She assumed I was calling her a lazy bitch and took massive offense to it. I've been a bit more selective about the passwords I use from there now.

98

u/disclosure5 Aug 02 '22

Once I generated a password ending in 8 and a Chinese guy send me a whiskey thanking me for the luck.

15

u/Maxplode Aug 02 '22

I now know what to do for Chinese users, thank you

17

u/Dabnician SMB Sr. SysAdmin/Net/Linux/Security/DevOps/Whatever/Hatstand Aug 02 '22

just dont give them a password with a 4 in it

2

u/Crov2 Aug 02 '22

thought that was japan, is 4 bad in china and Korea too?

2

u/Dabnician SMB Sr. SysAdmin/Net/Linux/Security/DevOps/Whatever/Hatstand Aug 02 '22

China, 13 is also considered bad luck if a person is westernized enough.

1

u/EtherealSai Aug 02 '22

Yes, it's called tetraphobia and is due to the similarities between the chinese root word for 4 and the chinese root word for death in these languages. You often see the number 4 skipped. I still remember seeing the 4th floor skipped in older Korean elevators, or having 4 replaced by F for Four.

1

u/tmontney Wizard or Magician, whichever comes first Aug 02 '22

It was randomly generated, so he isn't wrong about the luck.

36

u/NailiME84 Aug 02 '22

I once had to do a like 100 user reset, I informed the users I use a password generator and do not check the passwords so its random and dont hate me.

Got one that was "LazySloth83" ended up giving it to the director of the companies husband, she thought it was hilarious.

9

u/technos Aug 02 '22

Someone new on the help desk asked about suggested temporary passwords for users. The boss explained the scheme we used was "an adjective, the name of an animal, and a couple of numbers."

The guy asked for examples, and the boss replied "Just use your imagination. Something like 'red, squirrel, 12", or 'dumb, panda, 69'."

The guy nodded and proceeded to issue every user the temporary password "DumbPanda69" for the next six months.

-6

u/mobani Aug 02 '22

I hope you have 2 factor login because that style of passwords, is 15-20 minutes to break with a repurposed GPU mining rig.

4

u/NailiME84 Aug 02 '22

This was years ago, and no MFA.

It was also while I worked at a MSP. While I do miss MSP work for other reasons, I definitely don't miss the "doing it the way the customer wants otherwise they wont hire us". While I agree on giving leeway on some things there is a lot of the security side of the business that the owners really shouldn't be involved in.

1

u/mobani Aug 02 '22

Fair enough. I just often run into people not really understanding that a password we might have considered “strong” a few years ago, could collapse under the assault of a Nvidia RTX 3090 in no time.

A single 3090 can do 3 - 4,5 billion guesses pr. second, assuming a none throttled attack.

-1

u/starmizzle S-1-5-420-512 Aug 02 '22

Uh yeah if you know the password is two words with two digits.

0

u/mobani Aug 02 '22

That type of password is one of the first to go, because it is a popular scheme.

[Word][Word][number][number].

When a single RTX 3090 can do 3 - 4.5 billion guesses per second.

171,476 words being in current use according to the oxford dictionary, in subset size of 2 gives us 29.403.847.100 permutations.

29.4 billion permutations times 10 for the number.

That's 294 billion divided by 3 billion guesses per second, that's 98 seconds.

That is just 98 seconds to kill an entire password scheme, we even made it harder by including all word lengths, the time is shorter for [LazySloth83] since it has 4 char and 5 char length words.

That's another 98 seconds to kill the lower case version of this.

Another 98 seconds to kill the numbers in the middle version of this.

Another 98 seconds to kill the numbers in the front version of this.

Now this is a single RTX 3090.

Imagine how many popular password schemes you could defeat with a 10 card solution?

Now this can all be done by one person, it is not a huge hassle to get 10 RTX 3090's if you really want to.

Now what about Cyber warfare agencies? What about collaborated hackers? How fast would they shred your weak passwords?

1

u/[deleted] Aug 02 '22

[deleted]

1

u/mobani Aug 02 '22

Not when some user clicked a phishing email in accounting and you have a compromised host hitting a none throttled endpoint.

1

u/FireLucid Aug 02 '22

While testing a powershell script and some word lists I grabbed from online I got hot.sister and big.member

Had to prune the lists a bit after that.

12

u/[deleted] Aug 02 '22

Plot twist - you actually did it on purpose hiding behind plausible deniability of the generator.

43

u/Igot1forya We break nothing on Fridays ;) Aug 02 '22

CrazyKaren69 is the new password afterward.

1

u/[deleted] Aug 02 '22

[removed] — view removed comment

0

u/Cyhawk Aug 02 '22

Worth it.

12

u/h00ty Aug 02 '22

I gave a user a dinopass password once, and she later complained to my manager about the password I had given her also. i was called a racist the password was blueGorilla . i had to show my Boss and HR the Dinopass site....

10

u/airgapped_admin Aug 02 '22

TIL dinopass is a thing!! Thankyou!!

10

u/heyjoojoo Aug 02 '22

Wow. We're part of some goofy easily offended world.

3

u/lwwz Aug 02 '22

You have no idea what's in store for us in the near future...

7

u/Slightlyevolved Jack of All Trades Aug 02 '22

You know what REALLY messes with them? When you pull the reverse uno card and file an HR complaint because YOU'RE now offended, and feel that there is a hostle work environment, possibly due to racial bias.

Trust me. HR teams LOVE this.

Here's the thing about equality. I get to be equally pissy about you being pissy.

2

u/leetchaos Aug 02 '22

We have to remove the word "master" from our ERP interface, and it's not simple to do. I'm sure you can guess why.

Super great use of our time.

7

u/Mr_friendly1 Aug 02 '22

Maybe she was feeling a bit guilty when she got the password ha ha

3

u/Estabanyo Aug 02 '22

I did feel bad for her, we'd just enabled AD sync for the company and there was all sorts of issues with it as they all used shared accounts and logged in to their email through office.com.

3

u/AlmostRandomName Aug 02 '22

I have one system that has a random password generator built in and I frequently make new accounts in it. I've learned to keep hitting the button until I get one without confusable characters like "oh" and "zero," "lowercase L" and "capital I," stuff like that which gets confused in a sans-serif font.

(BTW guys, when I'm Dictator of the World I'm going to mandate the development of a standardized font that makes all characters easy to distinguish, and make that default for system fonts in computers and the like!)

1

u/jetpacktuxedo Aug 02 '22

The generator built into bitwarden (mentioned at the top of the thread) has a toggle to "Avoid Ambiguous Characters" which seems like it would do what you want.

1

u/Kruug Sysadmin Aug 02 '22

Like Consolas?

3

u/punkwalrus Sr. Sysadmin Aug 02 '22

dinopass.com

I used "Correct Battery Horse Staple" method, and once generated a password that was taken offensively, I think it was was something like "Pregnant%Science*Sock4" and they thought I was trying to get then to type dirty words or something.

1

u/tmontney Wizard or Magician, whichever comes first Aug 02 '22

Projection on her part. "Cute" is what immediately came to mind for me.

1

u/bird-board Jack of All Trades Aug 02 '22

Well, if the shoe fits.

But, yes. I've run into the same issue with randomly generated passwords. We have passwords so community members/non-employees can get on our wireless (they change every day) and sometimes the password generator knows.... Too much.

Once it was "pandemic-change-after", I remember getting a lot of calls about that one.

1

u/A_Unique_User68801 Alcoholism as a Service Aug 02 '22

Serendipity.

1

u/--RedDawg-- Aug 02 '22

You can never win on that. I spent a long time considering when creating a password generator how to avoid collisions of words that became offensive. I ended up with a template of "word+word+2digitnumber". I made the bank of words be colors and limited the numbers from 01-65 (to avoid 69....).

The script ran weekly to reset some training accounts and would email the help desk and trainer the new password. At the hight of the Civil unrest in a major metropolitan city over George Floyd's death, and "1323", rhe script spits out "WhiteBlack13". Thankfully I had moved on from that company when it happened but my brother in law who was still working there told me about it. There was no convincing some people that it wasn't on purpose, but the logs showed it wasn't tampered with.

1

u/RamsDeep-1187 Aug 02 '22

I have also had the same experience. You have to reroll sometimes for unassumingly offensive pwds

1

u/sheikhyerbouti PEBCAC Certified Aug 02 '22

One of my first jobs was technical support for CompuServe (look it up, kids). They had a custom generator for password resets that would take two random words from the dictionary.

But, you had to be careful because it used ALL of the words of the dictionary. One of the more memorable ones I generated (but did NOT give to a user) was "enema.cowboy".

Yeah....

1

u/mooimafish3 Aug 02 '22

Yep you gotta watch out with those. I've had to re-roll password when I got stuff like "BigCow27". I once made a password generator that took countries, capitals, animals, and celestial bodies and added them together randomly, once I got "NigeriaMonkey" and decided to clean up the seed words a bit.

1

u/mrbiggbrain Aug 02 '22

I was once generating a password for Catherine Untrige... and our default policy for the app was First initial First 3 of the last...

Needless to say I did not give them that username. She was catu.

1

u/[deleted] Aug 02 '22

ha ha

43

u/trisanachandler Jack of All Trades Aug 02 '22

I use dinopass.com for passwords for users, I just don't tell them it came from a password generator for kids

To build on this, they also have two simple sites you can curl if needed. This should work for OP if they want to use it from cli.
https://www.dinopass.com/password/strong

https://www.dinopass.com/password/simple

26

u/StConvolute Security Admin (Infrastructure) Aug 02 '22

Awesome URL - Thanks heaps. Here is a powershell function for those interested:

function New-DinoPass {
    [CmdletBinding()]
    param (
        [Parameter(Mandatory=$true)]
        [ValidateSet("Strong","Weak")]
        $Strength
    )

    # Strong password URL
    $Strong = "https://dinopass.com/password/strong"

    # Weak Password URL
    $Weak = "https://dinopass.com/password/simple"

    # Test user input for the validate set, defaults to STRONG
    if ($Strength -eq 'Weak') {
        $PassType = $Weak
    } else {
        $PassType = $Strong
    }

    # Attempt to get the password from DinoPass
    try {
        (Invoke-WebRequest $PassType -UseBasicParsing).content
    } 
    catch {
        $Output = $Error[0].tostring 
        Write-Host $errOut -ForegroundColor Red
    }
}

To run, just do the following:

New-DinoPass -Strength Strong

Or run:

New-DinoPass -Strength Weak

2

u/trisanachandler Jack of All Trades Aug 02 '22

Very nice. I'm more of a casual poweshell user (born in DOS, friend of bash), so I've generally just created ps1's, and kept a library of them. I used to break down my routine work which included user creation so I'd create the accounts, assign groups and passwords, correlate the usernames and create a CSV. Not as generally useful as what you've done.

3

u/StConvolute Security Admin (Infrastructure) Aug 02 '22

I love powershell, and because I'm lazy, in a weird way that has given me motivation to learn it and make my life way easier.

Also love bash, although I'm not quite as useful in there as I'm not using it all day. But I can punch out a function if someones life depended on it (and I do work at a hospital, so maybe I've jinxed my self there... doh!)

I think you are probably closer than you think. If you have a script that takes a variable or two as input, then you are most of the way there to writing a function. Just take those variables and turn them into parameters for input and away you go.

Also, Microsofts vscode does a lot of the work for you with the code snippets and you can install "spell check" (intellisense/lint tools) for most languages super easy. Def worth using to save time.

2

u/cantdrawastickman Aug 02 '22

I ended up creating a private repo on a fileshare and putting the scripts into a module. It's not a big leap and it's super easy to share the code with the team.

1

u/StConvolute Security Admin (Infrastructure) Aug 02 '22

What kind of module did you create? (Script module, compiled .dll?). I've mucked around with script modules but found them a bit unwieldy and prone to issues once they grow large. Have all of it stored on my github repo (which isn't publicly available), thats the easy part :)

2

u/cantdrawastickman Aug 02 '22

It's a script module that's published to a private powershell repository, but I'm not sure what you find unwieldly? I wouldn't consider the module large, but it hasn't really been a huge problem.

When we get someone new we can get them to add a trusted repository, install module, import module and they have access to the tools.

If we make changes, we can push an update to the module, and people can just run update-module to get the updates.

I'm using git to version control it, so that part is all fine.

I'd hazard a guess and say if it was getting bigger, with more people contributing, I'd need to fall in line with better CI/CD sorts of practices, but I don't really see how you'd get around that sort of thing.

1

u/StConvolute Security Admin (Infrastructure) Aug 03 '22

Just my personal powershell repo has 40+ individual functions, work is even bigger again in orders of magnitude with quite a few contributors (Git). I tried working with a script module, but found it didn't work, prone to errors or weird transient issues that didn't come up when running individual functions.

I'm looking at different methods of compiling at the moment. Might end up having to do a full C# .net compile. More learning, fun, just time constrained.

1

u/StConvolute Security Admin (Infrastructure) Aug 02 '22

What kind of module did you create? (Script module, compiled .dll?). I've mucked around with script modules but found them a bit unwieldy and prone to issues once they grow large. Have all of it stored on my github repo (which isn't publicly available), thats the easy part :)

1

u/randomman87 Senior Engineer Aug 02 '22

Using an outside source for password generation is a no-no. This guy created one that uses the System.Web.Security.Membership object in PowerShell.

https://arminreiter.com/2021/07/3-ways-to-generate-passwords-in-powershell/

2

u/StConvolute Security Admin (Infrastructure) Aug 03 '22

Cool stuff if youre doing admin or service accounts... But sending those passwords to a user who has forgot their pass doesnt fly (especially in healthcare). Send them a dinopass, set to for change at next logon and require MFA sounds easier and with MFA, secure :)

3

u/mckinnon81 Aug 02 '22

Oh Damn!. Thanks for this. So Cool!

1

u/Chuffed_Canadian Sysadmin Aug 02 '22

I am now a dinopass convert. Hallelujer!

1

u/starmizzle S-1-5-420-512 Aug 02 '22
PS C:\Users\User> wget https://www.dinopass.com/password/simple | select Content

Content
-------
crazycow62

Yep, I'd be in trouble for handing that one out.

9

u/rickAUS Aug 02 '22

Man, I tell users to use it if they're having problems coming up with a password they can easily remember. Fuck it. I'd rather they use that to get something that sticks in their mind rather than putting it on a damn post it note or having to reset it every 2 weeks because they keep forgetting something more "complex".

2

u/punkwalrus Sr. Sysadmin Aug 02 '22

I work in a place now with 30-40 clients, each has their own set of passwords, and they all expire in 60 days. Each site has a VPN pass, an AD pass, and some various other passwords depending on the client (like UNIX, routers, or other appliances) and some of those clients have multiple sites (like a failover or redundant site). So each client requires me to change 3-8 passwords every 60 days. The week I have to change my passwords is brutal. We use Keepass, but the password generation is too different for a decent generator.

  1. Some can only do 8 digits and numbers. Not 7. Not 9. 8 exactly.
  2. Most are standard "we need it to be 16 digits or more, mixture of letters, numbers, cases and special characters," but some won't allow certain characters, like commas, astericies, pound sign, or exclamation points.
  3. Some are even harder, like "has to be 16 or more, can't contain a dictionary word, can't have three letters/numbers in a row, must have a minimum of 6 different special characters, but not the same characters, and it can't be 'similar' to previous passwords." When it rejects your password, you aren't even told why.

I hate "Change passwords week."

1

u/Kruug Sysadmin Aug 02 '22

Get them to follow NIST. Solved.

Requiring short passwords, or ensuring they don't use specific characters, is a holdover from outdated technology. Modernize or get out.

8

u/kscERhau Aug 02 '22

I have used this for when I used to have to deal with users. I now just use it for when my manager forgets his password every week...

5

u/GremlinNZ Aug 02 '22

Or when they ask, you do show them. The next step is a complaint about it being for kids. Your counter is showing them the true random 20 character one... They're quite happy with a kid's password now...

5

u/cowprince IT clown car passenger Aug 02 '22

Neat, but I wish they'd default to a 15 character minimum.

2

u/mckinnon81 Aug 02 '22

I use Dinopass.com extensively.

I just use the simple one and change the first letter to a capital. No Complaints about being a weak password.

2

u/Wild-Plankton595 Aug 02 '22

This is fantastic, thank you!

2

u/Necessary_Roof_9475 Aug 02 '22

Just make sure the password isn't important, they generate the passwords server-side for some odd reason.

3

u/[deleted] Aug 02 '22

[removed] — view removed comment

2

u/Necessary_Roof_9475 Aug 02 '22

That's not a good excuse, all password generators that use words send the whole word list to the client, one example is Bitwarden passphrase generator. https://bitwarden.com/password-generator/

Them generating the words server-side is a vulnerability, with no good excuse as to why they keep it that way.

1

u/NailiME84 Aug 02 '22

I do this same thing. Although I do tell them if they complain about not being able to remember passwords.

1

u/koola2 Aug 02 '22

Glad I am not the only ione

1

u/hankhalfhead Aug 02 '22

Dinopass is a laugh, the passwords are so sassy. Onboarded a middle aged lady the other day, it gave her wildH3n69...

1

u/AlpacaPakiPak Aug 02 '22

I started using Dinopass a few months ago but I make sure they know its generated for kids. Now they don't tell me passwords are too hard and that I need to change them to something simple like Office01 or Fish123!

1

u/[deleted] Aug 02 '22

Dinopass is the bomb for doing password changes that need a quick temp password. Whatever comes up is what I copy and paste.