[Feature Request]: Shuffle character pool about generate-password HOT 2 CLOSED

Hey @brendanashworth ,

Thanks for the response. I just posted it here as a suggestion. I follow your argumentation that the current implementation is just fine and character pool shuffling does not add an additional layer of security.

Thanks for your time!

from generate-password.

So this in theory wouldn't change how nondeterministic the password output is in the typical case. In practice, the only time that this be of use is 1) a misspecified password generator that is not random and 2) when crypto.randomBytes is not truly random. Even in that case, this would only help a little bit against a targeted attack on this package.

I'm tempted to not vote for its inclusion, but is the pool shuffling a particularly small change? I don't see any negatives.

from generate-password.