Kaspersky Password Manager: All your passwords belong to us | Ledger

You can revert to English at any time by clicking on the language menu on the top right corner of the page. Blog posts, Donjon | 07/06/2021 Kaspersky Password Manager: All your passwords belong to us The password generator included in Kaspersky Password Manager had several problems. The most critical one is that it used a PRNG not suited for cryptographic purposes. Its single source of entropy was

[efcl]

疑似乱数でのパスワード生成の問題について。 0と1に偏りやすいモジュロバイアス、Kaspersky Password Managerが現在時間をseedに疑似乱数ベースのパスワードを生成しているため、掲示板などのアカウントの作成日時 + バッファで

[ledsun]

https://en.wikipedia.org/wiki/All_your_base_are_belong_to_us

[diet55]

“let’s study how passwords are generated in KeePass, an open source project.”"KeePass provides 3 methods to generate a password: a charset-based, a pattern-based and a custom generation method."

[mizdra]

Kaspersky 製パスワードジェネレーターの脆弱性の話。擬似乱数生成器の seed にパスワードの生成のリクエスト時刻を使用していたため、総当りでパスワードを容易に推測できた。めちゃめちゃ面白い。