Pros:
- I can’t remember “good” passwords anyway so remembering them is not an issue.
- they don’t look like passwords
- they are darn near impossible to guess (128 bits of entropy)
- easy to generate (offloads the “good PRNG” problem)
Cons:
- ???
In particular; what about for passwords that computers enter like for databases logins on some setups.
One major con is that you don’t necessarily have “128 bits of entropy” as stated in the original question.
Many GUID Algorithms have information embedded in them in predictable patterns, for example the MAC address of the computer, the date/time, or an incrementing sequence. Cryptanalysis of the WinAPI GUID has shown given the initial state one can predict up to next 250,000 GUIDs returned by the function UuidCreate
For example, I have about a 50% chance of guessing the first digit in the first position of the third group of digits since it will be either 1 (for V1 guids) or 4 (for V4 guids)
Source: http://en.wikipedia.org/wiki/Globally_Unique_Identifier