search

defuse / passgen

A password generator.
78 stars 25 forks source link

Wordlist Retrival #43

Closed ghost closed 7 years ago

ghost commented 9 years ago

Currently, the wordlist used is retrieved over bare HTTP from the following URL:

world.std.com/~reinhold/diceware.wordlist.asc

The server, world.std.com does offer HTTPS, but the certificate expired in 2004 - so that's not helpful. My suggestion would be to move the file to a different server that does offer HTTPS to eliminate this issue. Perhaps via Github Pages or include it in this repo, and reference the file directly.

Given the goal of the this application, downloading this file without any security or privacy seems like a bad idea.

defuse commented 7 years ago

We're downloading (a different list) over HTTPS from GitHub now: https://github.com/defuse/passgen/blob/master/Makefile#L33

ghost commented 7 years ago

I wonder if I could get a CVE for this... 😉