No, I said strong passwords. From Crypt::PassGen: "This module should not be used for high security applications (such as user accounts) since it returns passwords that are not mixed case, have no punctuation and no letters [sic]. This word can be used as a basis for a more secure password." Anything can be used as a basis for more security.

The lack of ANY discussion on pwgen's sourceforge project site or home page leads me to dismiss it. I'm not going to go slogging through their source code to determine their methods and analyze whether it's strong or weak-- at least, not until I hear their own analysis and agree with their executive summary of proper security methodology.

--
[ e d @ h a l l e y . c c ]

pwgen is somewhat better than Crypt::PassGen.

2;0 juerd@ouranos:~$ pwgen   
Sah1tohl dieC3bei Che2megu Sheicoc6 Booth2ha Fair6mei vaiSaij2 Bohlu6c
+o
We5quaep cae5Gioh geeBaic3 vah8Mait Caco5zah moh4veYu Laan0cai Xi2thei
+m
saevai7L Shahp3zu Beiv2tot moi5gieZ Du3sheig ciiv5Yah theRie7b wePo2ba
+h
si0yahKi nukahk8C hahvooG2 Baa1soor tu5teNie Hei6gedi Quaith0k miSh7ph
+e
Doo4vaiv kah4moKa booPo3gi siNg2wie poot6Nei Voh2teif Te2kiepe Quoo6th
+u
fiem1Thu wooTh5wu Daes6cah Lu7xoloo Vai0thae kooyah5J Bee2rahr chaiGh0
+c
Long4jee Bae8feih Chohph8b boQuaig5 Haexaw1k phu0Lire vubie1Ku Toh3boo
+l
cohWie4d vungaf7Y Boovah5n Lail0chi phu4Jeeh Bah6shoh yeiW0tho Ba8toto
+h
Teevee1f Guafay5w Phai4vai no4zaeNu tai0Rasa Naij8nah deiVeis1 Phoh8ph
+e
geiLiew1 Hi3cheng Baech5ru siYo8rei baila4Bo shuY3voo Haacoh5h ya6Hoph
+u
Li4chowe doeGhes0 Dekei0ka Buich1sa Joh4pugh We1wiesh so5vohFi Botif1x
+o
liiR8phu Bifeequ0 vieKuf6t phah3Nai tei5sieG thee7Cek Mei7kait Guo3zoh
+j
loaCoo7w cei3tieP phaeLu4w liMe4car ruGiw4ye beFe2mai Xioxo6li Theizot
+0
Rai1jexi ceezae5X ma7Jihae yaD7chab Phaith2m Cahyith8 Taengie1 Quai3de
+i
fo8kooXu Xia8deed Fae5thoh Xonae7fu reeJ2mai rau5neiV toaNou6h Paelee8
+m
Woth4ree sai0Zisi fie4Miez vi1Laeni Thie5xee Taxee0ye faiL3vee tau3Que
+e
zah1raCh Pohd0phi Tookax5s kai0baiS wahP5qui Haima2vo Shae4boh leePee8
+g
doco4Phu Pahvi0qu nae2Thah Va0yiese johT5rie yiHuqua7 Jeegaht7 wie6Dij
+o
raexo8Sh Keeghal4 kooS4gie phaSoo5d Lie7jaib mieC6bae rooGae3j yahhae1
+H
cohNg1mo do8baPei Lung0vup Cu1pahha waoNgu6v Duidaik3 Jeirahw8 We4teet
+h
[download]

It doesn't use punctuation, but in my opinion that is a Good Thing (TM).

Juerd # { site => 'juerd.nl', plp_site => 'plp.juerd.nl', do_not_use => 'spamtrap' }

And this is memorable how? If you really needed to memorize one or two of these, you could come up with some sentence from the sample. The average person can't or won't put up with that.

The point of my post is that totally random line noise like this gets written down, which is almost as weak as having no password at all. Security isn't mathematics, it's a systemic discipline which takes into account people's natural abilities and behavior, as well as maximizing the effort required to circumvent the weakest attack path.

--
[ e d @ h a l l e y . c c ]