[NEW] E2E password generator

[ostjen]

Created a new password generator for e2e private keys using readable words

Proposed changes (including videos or screenshots)

Issue(s)

Steps to test or reproduce

Further comments

[tassoevan]

generateMnemonicPhrase may be a good addition to our @rocket.chat/string-helpers package (currently on Fuselage monorepo), but I'm wonder if rely on Math.random() is fine. The previous solution was based on meteor/random, which differs in the pseudorandom generator used.

[ostjen]

I can switch to meteor/random, but I don't think it'd be good too still rely on meteor ... and @sampaiodiego do you think the generateMnemonicPhrase should be on @rocket.chat/string-helpers?

[sampaiodiego]

I'm not particularly worried about Math.random() .. if the issue is that it is using repeated words too often we can maybe change it to make sure it always use different words? or maybe adding a few more Math.random() calls would be enough

[ostjen]

I'm not particularly worried about Math.random() .. if the issue is that it is using repeated words too often we can maybe change it to make sure it always use different words? or maybe adding a few more Math.random() calls would be enough

I don't see Math.random() as a problem too, I think what @tassoevan was worried was just that we used meteor pseudorandom algo in the previous solution

[tassoevan]

@sampaiodiego @ostjen The problem with Math.random is not being cryptographically secure, so it's not an option for generating passwords. Unsurprisingly, sometimes Snyk marks Math.random() as a vulnerability. This is better: https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues

[sampaiodiego]

@sampaiodiego @ostjen The problem with Math.random is not being cryptographically secure, so it's not an option for generating passwords. Unsurprisingly, sometimes Snyk marks Math.random() as a vulnerability. This is better: https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues

the point is that Math.random is not being used to generate the password itself.. it's being used to get an index position of words array list..

[tassoevan]

it's being used to get an index position of words array list..

Which are combined to generate a password.

[sampaiodiego]

I don't know the root cause but while testing this I found out the keys were not successfully being generated anymore. not sure if the new password is not compatible (?)

changes already made