Why LLM-Generated Passwords Are Dangerously Insecure

(irregular.com)

16 points | by zdw 3 days ago ago

14 comments

  • catlifeonmars 2 hours ago

    This article has “why stabbing yourself with a screwdriver is bad” vibes.

  • gmuslera an hour ago

    This asks for a dictionary attack, not of common words, but for tokens from training that have some weight related to good passwords.

    At least regarding “normal” text generation, if you tell somewhat to the LLM that generate a Python script to write down a random password and use it it may have better quality.

  • ks2048 2 hours ago

    Had me wonder - if you ask an LLM for a random number 1...100, what distribution do you get? Surely many have run this experiment. Here's a link that looks like a good example, https://sanand0.github.io/llmrandom/

  • petcat 2 hours ago

    > LLM-generated passwords (generated directly by the LLM, rather than by an agent using a tool)

    This seems like kind of a pointless analysis to me? Humans also generate bad passwords. It's why we use crypto-hardened RNG tools.

    • jmull 2 hours ago

      It’s pointless if you believe no one is asking LLMs to generate passwords for them.

      • Pooge an hour ago

        Humans will always smash a screw with the handle of a spoon and be proud of themselves when they manage to do it.

  • himata4113 3 hours ago

    huh, for me it just generates <username>123 when I ask it to generate a password lol, sometimes adds a !, more often it just forces changeme rather than having any password.

  • Mordisquitos 2 hours ago

    I only clicked on the article with no intention of reading it (no time), but rather out of morbid curiosity as to why on earth anybody would need to be told that LLMs should absolutely not be used to generate passwords.

    > [...] Despite this, LLM-generated passwords appear in the real world – used by real users, and invisibly chosen by coding agents as part of code development tasks, instead of relying on traditional secure password generation methods.

    Jesus F'ing Christ. I hope to have time to read the whole thing later.

    • sowbug 2 hours ago

      The article is a bit of a strawman, and a bit of an advertisement for a security consultancy. If you ask someone else to pick a password for you, then it's a secret known by two people. So don't do that. That was true a thousand* years ago. It's still true today.

      *I know, I know, hash functions didn't exist on Earth a thousand years ago. Still true.

  • CrzyLngPwd 2 hours ago

    The article reads like it was written by a machine.

  • camgunz 2 hours ago

    Honest question, how much money would I make off an MCP service to generate passwords for claws and agents. Is there still gas left in the griftmobile, are prospectors still in need of shovels, will the gods bless my humble, shameless lunge for my slice of the pie?

    • TheDong 2 hours ago

      There is a marketplace for free skills (in this case a markdown file saying "run openssl rand -hex 32")

      I do not think there is any money for something that trivial.

      Even the irrationally exuberant VCs wouldn't put money in that.

    • throwatdem12311 2 hours ago

      Not much because if you gain any traction, within a day somebody will make a clone and make it free/open source.

      This is the default answer for all vibe coded slop business ideas for a while.

  • stanmancan 2 hours ago