opgen doesn't allow "ambiguous"
jpgoldberg opened this issue · 2 comments
It appears that adding "ambiguous" to the allow
flag in the command-line has no effect.
$ opgen characters -allow=uppercase,lowercase,digits,ambiguous -length=20 -entropy
115.63
$ opgen characters -allow=uppercase,lowercase,digits -length=20 -entropy
115.63
And we can see that with "ambiguous" we don't get any ambiguous characters
$ for i in {1..100}; do opgen characters -allow=uppercase,lowercase,digits,ambiguous -length=50 ; done | grep '[1I05Sl]'
$
So no ambiguous characters appeared in 100 50 character passwords for which "ambiguous" was listed as allowed.
Note that this appears to be a problem with the CLI only.
This is because the default exclude param is set to ambiguous. If you set exclude explicitly to none, it should work as you expect. I agree this isn't intuitive though. Perhaps all char set defaults should be thrown out as soon as one is defined explicitly?
After looking at the code, I see that there is a messy way to fix it (with lots of logic) or the quick way to fix it, which to not have any default excludes. I'm inclined for the quick fix.