In March 2019, security biz Kaspersky Lab shipped an update to KPM, promising that the application could identify weak passwords and generate strong replacements. Three months later, a team from security consultancy Donjon found that KPM didn’t manage either task particularly well – the software used a pseudo-random number generator (PRNG) that was insufficiently random to create strong passwords.
From that time until the last few months of 2020, KPM was suggesting passwords that could be easily cracked, without flagging the weak passwords for users.
“The password generator included in Kaspersky Password Manager had several problems,” the Donjon research team explained in a blog post on Tuesday.
“The most critical one is that it used a PRNG not suited for cryptographic purposes. Its single source of entropy was the current time. All the passwords it created could be bruteforced in seconds.”
SOURCE: https://www.theregister.com/2021/07/06/kaspersky_password_manager/