Security issue - Usage of a predictable RNG

[gargakshit]

This uses JavaScript's Math.random which is not a cryptographically secure random number generator. Therefore the generated numbers are not totally random, and predictable.

passgen/utils/createPassword.js

Line 15 in b42db1c

password += chars.charAt(Math.floor(Math.random() * chars.length))

This means the generated passwords can be predicted. Using this to generate passwords is a huge security flaw.

A quick fix would be to use crypto.randomBytes(number) from node's crypto module, or Crypto.getRandomValues() in a (relatively modern) browser.

Edit: Crypto.getRandomValues() seems to be implemented in node 15.0.0+, so it should be a universal solution for node 15+ and browsers