Just don’t be that guy that uses a website to generate passwords. If you’re going to generate passwords it needs to be a trusted utility that runs locally otherwise someone has your password.
If the website generating the password a) doesn’t know the site/account and b) doesn’t know the username then it doesn’t matter. And c) with 2fa knowing a password doesn’t grant access by itself.
If a site is decently coded, it would be run in client side scripting like JavaScript anyway. It wouldn’t require anything being sent to the site.
This is the crux of the issue. The average internet user, the kind of user going to a random website to generate a password, would not be able to find this out. For all we know, even without the username, a randomly generated password could be saved to a wordlist after it’s generated. That would be pretty smart, since now you have a list of known used passwords that someone went through the effort to generate to secure something more valuable. (Which would refute your points A and B)
And your point C, not always. By your same logic, you’d be comfortable using “password” as long as you have 2FA? There is always a possibility of 2FA being bypassed through some other vulnerability depending on its implementation. This is why it’s TWO (or multi) factor authentication. In case one factor is compromised, you have another layer of defense. If you use a compromised password (by either using “password” or a sketchy password generator), then you’ve effectively reverted yourself back to one factor authentication. Or zero, if you didn’t have MFA.
Don’t listen to anyone suggesting otherwise. Don’t use random websites. Either stick to a password manager to generate them for you, or take it completely offline with a dice roll-based generation.
Just don’t be that guy that uses a website to generate passwords. If you’re going to generate passwords it needs to be a trusted utility that runs locally otherwise someone has your password.
If the website generating the password a) doesn’t know the site/account and b) doesn’t know the username then it doesn’t matter. And c) with 2fa knowing a password doesn’t grant access by itself.
If a site is decently coded, it would be run in client side scripting like JavaScript anyway. It wouldn’t require anything being sent to the site.
This is the crux of the issue. The average internet user, the kind of user going to a random website to generate a password, would not be able to find this out. For all we know, even without the username, a randomly generated password could be saved to a wordlist after it’s generated. That would be pretty smart, since now you have a list of known used passwords that someone went through the effort to generate to secure something more valuable. (Which would refute your points A and B)
And your point C, not always. By your same logic, you’d be comfortable using “password” as long as you have 2FA? There is always a possibility of 2FA being bypassed through some other vulnerability depending on its implementation. This is why it’s TWO (or multi) factor authentication. In case one factor is compromised, you have another layer of defense. If you use a compromised password (by either using “password” or a sketchy password generator), then you’ve effectively reverted yourself back to one factor authentication. Or zero, if you didn’t have MFA.
Don’t listen to anyone suggesting otherwise. Don’t use random websites. Either stick to a password manager to generate them for you, or take it completely offline with a dice roll-based generation.
I’ve been using Pass since not long after it was released. Moved my OTPs into it as well.