This is the crux of the issue. The average internet user, the kind of user going to a random website to generate a password, would not be able to find this out. For all we know, even without the username, a randomly generated password could be saved to a wordlist after it’s generated. That would be pretty smart, since now you have a list of known used passwords that someone went through the effort to generate to secure something more valuable. (Which would refute your points A and B)
And your point C, not always. By your same logic, you’d be comfortable using “password” as long as you have 2FA? There is always a possibility of 2FA being bypassed through some other vulnerability depending on its implementation. This is why it’s TWO (or multi) factor authentication. In case one factor is compromised, you have another layer of defense. If you use a compromised password (by either using “password” or a sketchy password generator), then you’ve effectively reverted yourself back to one factor authentication. Or zero, if you didn’t have MFA.
Don’t listen to anyone suggesting otherwise. Don’t use random websites. Either stick to a password manager to generate them for you, or take it completely offline with a dice roll-based generation.
This is the crux of the issue. The average internet user, the kind of user going to a random website to generate a password, would not be able to find this out. For all we know, even without the username, a randomly generated password could be saved to a wordlist after it’s generated. That would be pretty smart, since now you have a list of known used passwords that someone went through the effort to generate to secure something more valuable. (Which would refute your points A and B)
And your point C, not always. By your same logic, you’d be comfortable using “password” as long as you have 2FA? There is always a possibility of 2FA being bypassed through some other vulnerability depending on its implementation. This is why it’s TWO (or multi) factor authentication. In case one factor is compromised, you have another layer of defense. If you use a compromised password (by either using “password” or a sketchy password generator), then you’ve effectively reverted yourself back to one factor authentication. Or zero, if you didn’t have MFA.
Don’t listen to anyone suggesting otherwise. Don’t use random websites. Either stick to a password manager to generate them for you, or take it completely offline with a dice roll-based generation.