Could using a generated key from an online service be considered a risk?

Question

With some colleagues we're having a debate regarding the randomkeygen.com website.

I do think that there is a security risk using the generated keys of this (or any of this kind) website.

Why ? Here's my thoughts:

What prevents the owner of the website from storing generated password inside a database and releasing it as a dictionary attack?

I do know that generated password combinations are not infinite, but what if with this dictionary hackers try a password they know that has been generated (so more likely to be used)

We can even think of a heatmap used for Analystics to know which kind of generated passwords are used to narrow the scope of possibly used passwords (or even a Javascript that sends the password to the database once it has been copied into the clipboard, but that is a little too obvious for my demonstration).

PS: I do not work in security so I do feel sorry if I say wrong things. I know that my theory is not a big "security breach" but if we see it only in a statistic way, there's more chance if we reduce the number of possible password.

So, could using a generated key from an online service be considered a risk?

Answer 1

1. Nothing prevents him from storing the password
2. Yes it is a risk, because you do not know what is happening with the assigned key on the backend of the website

Writing a proper keygen isn't hard, there are many examples on how to write a simple script that does this for you. It's important however that you use the correct amount of entropy for the randomness of the generated key. Please refer to the Bear's answer here.

Answer 2

It depends on your attack profile, but yes, it's theoretically a risk. It is a likely attack vector? No. Typical attacks use permutations on dictionaries of common passwords. Such a dictionary needs to be large enough to get most of the passwords and small enough to be practical.

And in fact, very small is pretty practical. According to one analysis of some recently leaked passwords, a dictionary of only 100 passwords gets you about 40% of all accounts, while 500 gets you 71%. There are dictionaries available of many tens of thousands of real leaked passwords, so attackers typically don't have to guess.

Nonetheless, there is the possibility that the site is malicious and recording the passwords it generates. Or perhaps its owner is less-competent, and it's actually generating passwords based on a broken random number generator.

You can alleviate the first problem by generating your passwords on your own computer. There are tools such as LastPass which can perform this exact same process locally in the browser as an extension.

These passwords are very likely to be random enough, which is to say that they won't appear on the top 50,000 list. Whether they exhibit some bias can best be determined by actually doing a statistical analysis. Typically they use the system's built-in crypto RNG, which is typically pretty safe.

But even then, the danger in having a password with a 1% bias away from certain values isn't particularly problematic for a one-off password. The problems arise when you create a statistically significant number of these passwords (thousands, millions) such that the bias turns into a pattern. As it is, an attacker isn't going to bother tuning his algorithm to match the bias of a given password generator; it's not with his time: Brute-forcing a 122-bit password is no more feasible than a 128-bit password.

If your password is both long and reasonably unpredictable, then you're reasonably safe.

Answer 3

Another thing to bear in mind is that the site itself may be good natured and does not keep a record of any generated values but it might be possible for your generated values to be sniffed across the network.

The randomkeygen.com site in your example is accessed over plain HTTP, so it is vulnerable to a MITM attack. At the moment of writing there is no HTTPS version, this seems to give you the default Apache Server page and a certificate warning.

However, there are other services such as random.org that do support HTTPS to ensure that your generated values cannot be sniffed.

In their own FAQ, this site itself warns against using any values for security purposes:

Q2.4: Are the numbers available in a secure fashion? Yes, since April 2007 you can access the server via https://www.random.org/

We should probably note that while fetching the numbers via secure HTTP would protect them from being observed while in transit, anyone genuinely concerned with security should not trust anyone else (including RANDOM.ORG) to generate their cryptographic keys.

I would say this applies to all 3rd party services and you should really generate your own keys using your own local software. The RoboForm software includes a secure password generator: