我可以使用 python 的 random 模块制作一个安全的基于“纯函数”的密码生成器吗？

Question

So I was looking for ways of managing my passwords without using a server-based password manager like LastPass and I came across https://lesspass.com . According to the website, this tool creates the same password for the given master password, username and website. I really liked the idea and decided to make my own proof of concept in python using the random module. I made this simple function:

    import random
    import string
    import os


    MASTER_PASS=os.environ.get('MASTER_PASS')


    def generate(platform, user, length):
        random.seed(platform+user+MASTER_PASS)
        letters=string.ascii_letters +string.digits + string.punctuation
        password=""
        for i in range(length):
            password+=random.choice(letters)
        print(password)



    generate("facebook", "xyz.abc", 32)

I think this should be secure enough as long as nobody knows my MASTER_PASSWORD but I cannot shake the feeling that this is somehow stupidly unsafe. Can anyone point out the glaring flaws in this approach and suggest some ways to improve the robustness?

EDIT:

I think some clarification is needed on my part. I want to make a program where I can input my platform name, username and master password to generate a password. Also, it is imperative that I get the same password whenever I input the same combination. I am essentially trying to create a vault-less password manager that does not rely on any servers to store my passwords.

Answer 1

The random module is not cryptographically safe. You should use the secrets module instead.

In particular, secrets should be used in preference to the default pseudo-random number generator in the random module, which is designed for modelling and simulation, not security or cryptography.

The API is identical, so your code will work.

As far as the approach is concerned, this is pretty much how other password generators work. Just keep in mind how much entropy is actually in the password (depends on length & the total size of letters ).