Password guessing via biased phoneme generation

Predictable password generation in Pwgen 2.06 allows context-dependent attackers to guess phoneme-mode passwords by brute force. The default phoneme generator draws from a heavily biased, nonuniform distribution with a limited effective keyspace, causing some eight-character outputs to recur far more often than uniform random generation permits. An attacker must obtain a verifier or reach an authentication service that uses a generated password; successful guessing compromises only the account protected by that password.