In this case, the standard C function "rand", which is a pseudo-random number generator, is initially seeded using the C functions "time", but later iterations use "rand" instead. According to the ANSI C standard, "time" returns a value of type "time t", which is implementation-defined, but most commonly a 32-bit integer containing the current number of seconds since January 1, 1970 ("see:" Unix time). There are about 31 million seconds in a year, so an attacker who knows the year (a simple matter in situations where frequent password changes are mandated by password policy) and the process ID that the password was generated with, faces a relatively small number, by cryptographic standards, of choices to test. If the attacker knows more accurately when the password was generated, he faces an even smaller number of candidates to test – a serious flaw in this implementation.