1Password/spg

opgen doesn't allow "ambiguous"

jpgoldberg opened this issue · 2 comments

It appears that adding "ambiguous" to the allow flag in the command-line has no effect.

$ opgen characters -allow=uppercase,lowercase,digits,ambiguous -length=20 -entropy
115.63
$ opgen characters -allow=uppercase,lowercase,digits -length=20 -entropy
115.63

And we can see that with "ambiguous" we don't get any ambiguous characters

$ for i in {1..100}; do opgen characters -allow=uppercase,lowercase,digits,ambiguous -length=50 ; done | grep '[1I05Sl]'
$

So no ambiguous characters appeared in 100 50 character passwords for which "ambiguous" was listed as allowed.

Note that this appears to be a problem with the CLI only.

This is because the default exclude param is set to ambiguous. If you set exclude explicitly to none, it should work as you expect. I agree this isn't intuitive though. Perhaps all char set defaults should be thrown out as soon as one is defined explicitly?

After looking at the code, I see that there is a messy way to fix it (with lots of logic) or the quick way to fix it, which to not have any default excludes. I'm inclined for the quick fix.