Below script is used to generate passphrases for gpg (or anything really).
Do you see any blatant security mistakes in it?
I wrote it by myself, because I couldn't find any passphrase generator that doesn't use external services and uses /dev/urandom.
Note: I run it with
./generator.bash 4 > x && vim x so stdout is not printed to the terminal, but I'm not sure if this is neccessary. I'm thinking that somewhere terminal history could be stored.
#!/bin/bash # Usage: ./passphrase_gen.bash 4 > x && vim x # We redirect to file and print via vim so no history is saved anywhere. # Repeat after you get passphrase you like. Memorize it/write it down # and remove x afterwards. set -eo pipefail words=/usr/share/dict/words # https://serverfault.com/a/214620/216850 sudo rngd -r /dev/urandom n=$1 # print $n randomly chosen words from $words file for i in $(seq 1 $n); do # https://unix.stackexchange.com/a/268960 random=$(od -vAn -N4 -tu4 < /dev/urandom) lines=$(cat $words | wc -l) line=$((random % lines)) awk "NR==$line" $words done