Based on the context and how it's written, I get the feeling he never intended it to be a full fledged article, just some tweets, then it grew organically from there. This was never an instructional piece of work.
I get this sense from a lot of people in security: smart enough to follow conventional advice, too uneducated to explain why.
This password manager will almost certainly generate basically anything that will get hashed and salted in the end, so it’s all irrelevant as long as it’s basically not outputting passwords from exposed lists, and even then it’s still mostly irrelevant.
I have never once heard of particular passwords being an issue in the industry outside of social engineering or common password lists. Completely irrelevant. It’s almost always data breaches.
Never does it hit the news that 3.5 million password were cracked due to hackers reverse engineering the time the accounts were created against popular password managers.
What nonsense.
If you simply generated a password from /dev/urandom, it would have almost as much consequence as whatever they’re doing here.
Edit: The source article referenced is the only thing meaningful, which explains the severity, everyone else commenting on it was a dope.
Seeding the random number generator with the current time, measured in seconds, removes any element of randomness from the password generator. It makes it straightforward to produce a list of every password that this software has ever generated, or will generate in the future.