Skip to content

Latest commit

 

History

History
203 lines (130 loc) · 19.6 KB

help.md

File metadata and controls

203 lines (130 loc) · 19.6 KB
Raw
layout title
default
Help

Contents

What is DicePhrase?

DicePhrase is a browser extension that helps you easily create strong, memorable passphrases, such as FragrantRenewedAnyoneBakedPossum or BazookaClangUnstuckTransferQuoteJokingly, by rolling six-sided dice to randomly select from a set of 7776 possible words. This system creates passphrases that are more unguessable than if you were to pick words on your own or trust the computer to generate words automatically.

It's based on best practice strategies for creating passphrases by the Electronic Frontier Foundation, security technologist Micah Lee, and the Diceware project.

Why passphrases instead of passwords?

Long, random passphrases are more secure because they're more difficult for an attacker to guess than simple passwords. While a password like Batman1989 is easily guessed and &1KJl6a8y$g*01W}i21!MZ is too hard to remember, random passphrases like DonutConfinedCurveHurricaneJuggleWidget are strong and memorable.

Passphrases don't need to be personal to be memorable. Personal things like birthdays, addresses, anniversaries, names, lyrics, books, movies, etc. are not very secret; anyone can find out your address, pet's name, or favourite songs. Picking words randomly ensures your passphrase is unbiased and unpredictable.

How does it work?

You do five dice rolls to randomly select each word for your passphrase, so if you need a 6-word passphrase, that's 30 dice rolls. Input the numbers into DicePhrase, which will then use them to look up corresponding words in a table of 7776 possible words to generate your new passphrase. With each additional word, the chances that anyone could ever guess your passphrase become exponentially smaller.

Why use dice?

Depending on the threats you're trying to protect against, it may be safer to use dice to create passphrases than to have the computer generate random numbers. Generally, the main threat of concern here is random number generation software with flaws in its implementation that cause predictable output. The output may look completely random to you, but can potentially be predictable in some way. You wouldn't want people to predict your passphrase, right?

The complex systems that computers use for creating randomness are more prone to errors and hacking than physical dice, and even the best software can still have undiscovered bugs in its code. There are numerous examples of weaknesses and fatal flaws in computer-based random number generators, whereas dice are a more reliable and transparent source of true randomness.

Dice can be purchased at toy stores, dollar stores, or online from the Electronic Frontier Foundation or eBay. You can also make your own dice out of materials like clay or wood. Rolling multiple dice at once can make passphrase generation quicker.

If you don't need this high level of unpredictability for your passphrases, DicePhrase can generate cryptographically secure pseudo-random numbers without dice when you click "Skip" in the main popup window. However, cryptographically secure pseudo-randomness is still not truly random, so using dice is recommended for making the most secure passphrases.

Under no circumstances should you try to input random numbers into the dice roll text box by "bashing the keyboard" or using your own mind to think up numbers. Keyboard layouts and human minds have too much bias to be random, as both will undoubtedly favour some numbers over others. Either roll real dice or let the computer automatically generate pseudo-random numbers.

When should I use passphrases?

Passphrases are ideal when used to encrypt information. They're perfect as the master password for a password manager so you only need to remember a single strong passphrase. They're also great for securing WiFi networks, disk encryption, PGP or SSH encryption keys, and any other encryption system. Use them whenever you need memorable authentication in general.

For online accounts, having strong passphrases is good but may not be enough protection from attackers who use techniques like phishing to steal credentials. You should enable Two-Factor Authentication, which adds a second step to the login process, and consider saving unique passphrases for each account in a password manager.

How can I memorize a passphrase?

Through repetition, you'll quickly remember a passphrase. If necessary, temporarily write it on a piece of paper; then after a few days of repeated use, when confident that you've memorized the passphrase, destroy the paper.

You should save all your passphrases in a password manager application so you only need to memorize the master passphrase that unlocks the database, and it's no longer critical for you to remember any of the passphrases contained in the database.

How many words should I use?

The more words in your passphrase, the stronger it is. With each additional word, exponentially more time is needed for an attacker to guess the passphrase.

The table below shows how long it might take an attacker to guess different lengths of passphrases by brute-force, a process that involves trying every possible combination of words until the correct passphrase is found.

Number of words Average brute-force time Rating
3 or fewer Less than 1 second Unsafe
4 30 minutes Unsafe
5 5.4 months Dubious
6 3,505 years Safe
7 27,255,688 years Very safe
8 211,940,235,585 years Very safe

This example assumes the adversary is capable of one trillion guesses per second, a rate that was known to be possible in 2013 and that will only become faster and common to more attackers as technology improves. A 5-word passphrase may take 5.4 months to crack today, but in the future it will take only days and eventually just minutes.

If the adversary can access raw encrypted information, such as a password manager database file or an encrypted disk, he or she can steal a copy of the data and mount an offline brute-force attack, guessing passphrases at top speed with low risk of detection. But if the attacker is trying to access an online resource, such as a website account, the brute-force guessing speed will not only be greatly limited by connecting to a remote server, but the server may also lock out the attacker after too many incorrect password guesses.

If unsure about how many words to use, consider the value of what you're trying to protect, who might want to access it, how capable they are of accessing it, and what the consequences would be if it became compromised.

Are numerals and special characters necessary?

If a passphrase is long enough, such as 6 random words or more, then it may not need numbers or special characters (eg. 0123456789 or ~!@#$%^&*). A long passphrase composed only of words made from alphabetical letters may be strong enough on its own.

Numbers and special characters can make your passphrase less memorable. For example, consider ChattingImprintPlayroomIllusionKoala versus ChattingImprintPlayroom{9167. Both offer roughly the same level of security, but the first one is easier to memorize.

Sometimes, when using spaces to separate the words, as in Chatting Imprint Playroom Illusion Koala, it's still easy to memorize and the spaces may qualify as special characters, depending on the service's requirements.

Password manager applications

Password managers keep an encrypted, searchable database of all your passphrases, making it easy to have different passphrases for every website or service. The only passphrase you need to remember is the master one to unlock the database.

Program Operating systems Free & open source Cost
KeePassX Mac, Windows, GNU/Linux Yes Free or donation
MiniKeePass iOS Yes Free or donation
KeePassDroid Android Yes Free or donation
Password Safe Windows Yes Free or donation
1Password Mac, Windows, iOS, Android No $

Use a long passphrase as the master password. The master password must be very strong, otherwise anyone who manages to access the database file could break into all of your accounts.

Also, make sure to keep backup copies of the database file on separate hard drives in case of computer failure.

Help improve DicePhrase

Anyone is welcome to help build this program. Together, we can make it even better. You can help by:

  • Reporting software bugs or suggesting new ideas on the issue tracker.
  • Submitting code changes or fixes.
  • Translating it into other languages.
  • Auditing the code and reporting security issues.
  • Telling your friends about DicePhrase and/or sharing it with them.

Development happens on the DicePhrase project on GitHub. If you don't have a GitHub account, you'll need to sign up for one first. If you'd rather not create an account, you can make contact through alternate channels.

By submitting code changes, you agree to licence your work under the GNU General Public License, version 3 or later. By submitting documentation changes, you agree to licence your work under the GNU Free Documentation License, version 1.3 or later.

DicePhrase's security design

DicePhrase protects the confidentiality of your passphrases while you create them, preventing a variety of potential threats. However, there are related threats that are outside the scope of DicePhrase that you may need to prevent on your own.

DicePhrase guards against these threats
  • It's very hard for attackers to guess randomly-generated passphrases. Even if the attackers know personal information about you, such as your address or pet's name, it won't help them crack randomly-generated passphrases.
  • If the software random number generator is faulty, resulting in predictable output, passphrases created by rolling dice will still be unpredictable.
  • Nobody who has casual access to your computer can determine how you customize passphrases. Your customization preferences aren't saved.
  • Other people looking at your screen won't necessarily see the passphrases you create. Passphrases are concealed from view until you click the Show button. You can also copy a passphrase without seeing it by using the Copy button.
  • Sensitive data isn't left lying around after you're done with it. After 10 minutes, tabs containing passphrases close and the clipboard is cleared automatically. (However, the clipboard can't be cleared if you quit the browser prior to the time limit expiring. Also, if the time limit hasn't yet expired and you create another passphrase, the timer will reset back to 10 minutes.)
  • DicePhrase uses the minimum browser permissions necessary to do its job. It only has permission to modify data you copy and paste and to use the Alarms API so the clipboard can be cleared automatically after a timer expires. It cannot read the clipboard's contents.
  • Your passphrases and dice roll numbers never leave your computer because the extension can't make any network connections. Due to its strict Content Security Policy, DicePhrase is forced to operate completely offline.
  • Both the Google and Firefox accounts used for managing DicePhrase on the Chrome Web Store and Mozilla AMO are guarded with two-factor authentication to prevent attackers from accessing the accounts and publishing malicious, backdoored updates to the extension.
  • Management of DicePhrase will never be transferred to a malicious third party. Developers sometimes sell ownership of their browser extensions to buyers who later transform them into adware or malware, but DicePhrase will not participate in such transfers.
DicePhrase doesn't guard against these threats
  • It's ultimately your decision where to keep passphrases safe because DicePhrase doesn't save them. A password manager is the ideal tool for this. Make sure you keep backup copies of the password manager database file on separate hard drives.
  • If malware exists on your computer, it may be sending your passphrases to an attacker. Preventing malware is a broad topic, but here is some basic introductory advice.
  • You might need more than just a strong passphrase to protect online accounts from threats like phishing. Many websites support Two-Factor Authentication, which adds an additional layer of protection.
  • If a browser or operating system vulnerability is exploited, DicePhrase could be affected too because extensions are dependent on the browser and OS for security. Always keep your browser and OS updated to the latest versions.
  • DicePhrase can't prevent you from trying to input random numbers by "bashing the keyboard" or using your mind to think up numbers. This is not very random, you should roll real dice instead.
  • DicePhrase's feature for generating random numbers without dice is not guaranteed to be secure because it depends on the computer's ability to generate pseudo-randomness. DicePhrase uses the browser's cryptographically secure pseudo-random number generator, but due to the complexity in how computers generate randomness, that generator could still be faulty. Instead, you should roll real dice to ensure total unpredictability.
  • Because the cryptographic signing keys for Chrome and Firefox extensions on the Chrome Web Store and AMO are controlled by Google and Mozilla, if an attacker obtained these keys from Google or Mozilla then they could be used to serve malicious DicePhrase updates to you. The likelihood of this happening is low.

If you need security beyond this design, then you should create passphrases offline by printing the word list on paper and rolling dice to look up words manually instead of using DicePhrase.

Reporting security vulnerabilities

To help ensure DicePhrase remains as safe as possible for users, you're encouraged to audit its code for undiscovered security issues. Vulnerabilities of interest include anything that affects the confidentiality or integrity of user-generated passphrases, as well as anything that affects DicePhrase's ability to guard against specific threats, excluding the categories of other threats that DicePhrase doesn't guard against.

If you find a security vulnerability, please report it by sending detailed information on how to reproduce it here, preferably using encrypted messaging. Please consider allowing up to 90 days for the vulnerability to be fixed before publicly discussing it.

Get support

If you need assistance with DicePhrase and your issue wasn't resolved by reading this help document, you can get in touch here or on Twitter.

Copyright and licences

DicePhrase is copyright © 2024 Lucas Bleackley Petter.

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

Permission is also granted to copy, distribute and/or modify DicePhrase's documentation under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License".

The full text of both licences is bundled with DicePhrase here.

Credit to third-party software used in DicePhrase