New Diceware passphrase generator #373

TheZ3ro · 2017-03-04T14:24:04Z

closes #21

Description

This PR adds a diceware-like passphrase generator.
It's possible to select the Word Count, the Word Separator and the Word List.
Currently 3 worlist are included (EFF Long, EFF Short and EFF Short Distant).
The Passphrase entropy is calculated by log2(wordlist.size) * wordcount.
All the options are automatically loaded and saved.

Advanced users If you want to add a different wordlist by yourself, you can add it in the KeePassXC installation folder. This will require a restart to see the wordlist in the comboBox.
If you select a wordlist with less 1000 words, the generator won't let you generate passphrase unless you select another wordlist.

I've removed the old PasswordComboBox widget since it isn't used anymore.

Problems that needs fix:

In the entry edit view the Password generator is very small because there isn't anymore space
In the entry edit view if the Generator is open you can't maximize the window.

How Has This Been Tested?

Screenshots (if appropriate):

Types of changes

✅ New feature (non-breaking change which adds functionality)

Checklist:

✅ I have read the CONTRIBUTING document. [REQUIRED]
✅ My code follows the code style of this project. [REQUIRED]
✅ All new and existing tests passed. [REQUIRED]

louib · 2017-03-04T20:40:59Z

src/core/PassphraseGenerator.cpp

+        m_wordlist.append(in.readLine());
+    }
+
+    if (m_wordlist.size() < 1000) {


@TheZ3ro why this limit? Why not rely on the entropy meter to let the user know that the word list is too small?

@louib The limit is for preventing users use small wordlist. The entropy-meter will let the user use a phassphrase with 5 word from a 10-word wordlist but the user can simply ignore the "Password Quality: Bad" label and go with it.

IMHO 1000 is also way too low.

@phoerious EFF short and EFF short distant wordlist are 1200 words long

I don't really see a reason to use the short lists.

4000 is a fair limit?

Sounds better than 1000.

louib · 2017-03-04T20:45:27Z

src/core/PassphraseGenerator.cpp

+
+    // In case there was an error loading the wordlist
+    if(m_wordlist.length() == 0) {
+        QString empty;


@TheZ3ro could we do return QString(); here instead?

louib · 2017-03-04T20:45:55Z

src/core/PassphraseGenerator.cpp

+    }
+
+    QString passphrase;
+    for (int i = 0; i < m_length; i ++) {


@TheZ3ro i++?

louib · 2017-03-04T20:52:28Z

src/core/PassphraseGenerator.cpp

+    QString passphrase;
+    for (int i = 0; i < m_length; i ++) {
+        int word_index = randomGen()->randomUInt(m_wordlist.length());
+        passphrase.append(m_wordlist.at(word_index));


@TheZ3ro purely stylistic, but here you could create a QStringList of all the randomly chosen words, and then use QStringList::join(m_separator).

QStringList words; for (int i = 0; i < m_length; ++i) { int wordIndex = randomGen()->randomUInt(m_wordlist.length()); words.append(m_wordlist.at(wordIndex)) } return words.join(m_separator);

louib · 2017-03-04T20:52:55Z

src/core/PassphraseGenerator.cpp

+    QString passphrase;
+    for (int i = 0; i < m_length; i ++) {
+        int word_index = randomGen()->randomUInt(m_wordlist.length());
+        passphrase.append(m_wordlist.at(word_index));


@TheZ3ro wordIndex?

louib · 2017-03-04T20:54:24Z

src/gui/PasswordGeneratorWidget.cpp

@@ -54,6 +62,12 @@ PasswordGeneratorWidget::PasswordGeneratorWidget(QWidget* parent)
        m_ui->entropyLabel->setFont(defaultFont);
        m_ui->strengthLabel->setFont(defaultFont);
    }
+
+    m_ui->comboBoxWordSeparator->addItems(QStringList() <<" " <<"#" <<";" <<"-" <<":" <<"." <<"@");


@TheZ3ro shouldn't there be spaces around the << operators?
<< " " << "#" << ";" << "-" << ":" << "." << "@"

louib · 2017-03-04T20:55:42Z

src/gui/PasswordGeneratorWidget.cpp

@@ -65,6 +79,7 @@ PasswordGeneratorWidget::~PasswordGeneratorWidget()

 void PasswordGeneratorWidget::loadSettings()
 {
+    // Password config


@TheZ3ro we should remove the space at 87 to group all the password config then.

louib · 2017-03-04T20:58:45Z

src/gui/PasswordGeneratorWidget.cpp

@@ -196,13 +248,13 @@ void PasswordGeneratorWidget::colorStrengthIndicator(double entropy)
    // Set the color and background based on entropy
    // colors are taking from the KDE breeze palette
    // <https://community.kde.org/KDE_Visual_Design_Group/HIG/Color>
-    if (entropy < 35) {
+    if (entropy < 40) {


@TheZ3ro maybe these thresholds could be configurable at some point, for users that have different security requirements.

I don't know. I think the current entropy value are almost nice for the current password cracking technology.

@TheZ3ro but a user might also want to increase those values.

louib · 2017-03-04T21:02:07Z

src/gui/PasswordGeneratorWidget.cpp

-    m_generator->setLength(m_ui->spinBoxLength->value());
-    m_generator->setCharClasses(classes);
-    m_generator->setFlags(flags);
+        m_dicewareGenerator->setLength(m_ui->spinBoxWordCount->value());


@TheZ3ro setLength is a bit ambiguous, since it's not really the length of the resulting passphrase, but instead its word count. In fact, the name of the spin box is wordCount. Why not setWordCount?

TheZ3ro · 2017-03-04T21:30:06Z

@louib I think I've fixed most of the thing. Should be nice to base #343 over this PR

louib · 2017-03-04T23:15:37Z

@TheZ3ro I tested the new feature locally (not extensively though). Works great!

TheZ3ro · 2017-03-04T23:22:05Z

@louib have you tried the 2 problem described in the first post?

louib · 2017-03-05T20:39:10Z

@TheZ3ro no, I only tested the basic functionalities (generating and changing the settings, apply, etc)

J-J-Chiarella · 2017-03-07T06:32:19Z

Could you please add the underscore ( _ ) as an option for word separator?

It acts as a space, while still being a printable character.

Also, unlike the dash ( - ), it won't conflict with words in the list. Some words in the list are hyphenated. If anything, I think that dash should not be an option. But if I have to choose one thing to change, it would be to add the underscore. With popular sites like reddit allowing underscore and twitter making it the only acceptable punctuation, the underscore is not as obscure. (Certainly not as obscure as backtick or backslash or pipes.)

TheZ3ro · 2017-03-07T08:06:23Z

@J-J-Chiarella yes of course

TheZ3ro · 2017-03-08T16:05:19Z

Rebased on top of develop

phoerious

See comment.

phoerious · 2017-03-16T23:06:42Z

Couple of things:

0 words doesn't make any sense, minimum should be 1
I don't really like the giant Apply and Generate buttons, maybe experiment with that a little more
We should only ship one (very large) word list and hide the dropdown unless the user installs a custom word list
If there is more than one list, does the generator remember the most recently used one? If not, it should
The word separator setting should be a simple input field, no reason to restrict what characters a user can choose (and of course: KISS)
Replace tab titles Random and Diceware with Password and Passphrase
Labels and widgets should be arranged in a grid with the labels being aligned to the right

TheZ3ro · 2017-03-17T00:26:46Z

louib · 2017-03-21T00:24:30Z

src/core/PassphraseGenerator.cpp

+
+}
+
+void PassphraseGenerator::setWordlist(QString path)


@TheZ3ro setWordList?

TheZ3ro · 2017-03-21T23:06:28Z

Rebased and fixed @louib

louib · 2017-03-28T19:02:57Z

@phoerious are we good with this one?

droidmonkey · 2017-04-09T16:37:19Z

Excellent work on this everyone, this is a fantastic enhancement to the password generator!

davad · 2017-04-17T21:55:27Z

@TheZ3ro Thanks for doing this! Sorry I couldn't be more help. Life got busy 😬.

- Added YubiKey 2FA integration for unlocking databases [#127] - Added TOTP support [#519] - Added CSV import tool [#146, #490] - Added KeePassXC CLI tool [#254] - Added diceware password generator [#373] - Added support for entry references [#370, #378] - Added support for Twofish encryption [#167] - Enabled DEP and ASLR for in-memory protection [#371] - Enabled single instance mode [#510] - Enabled portable mode [#645] - Enabled database lock on screensaver and session lock [#545] - Redesigned welcome screen with common features and recent databases [#292] - Multiple updates to search behavior [#168, #213, #374, #471, #603, #654] - Added auto-type fields {CLEARFIELD}, {SPACE}, {{}, {}} [#267, #427, #480] - Fixed auto-type errors on Linux [#550] - Prompt user prior to executing a cmd:// URL [#235] - Entry attributes can be protected (hidden) [#220] - Added extended ascii to password generator [#538] - Added new database icon to toolbar [#289] - Added context menu entry to empty recycle bin in databases [#520] - Added "apply" button to entry and group edit windows [#624] - Added macOS tray icon and enabled minimize on close [#583] - Fixed issues with unclean shutdowns [#170, #580] - Changed keyboard shortcut to create new database to CTRL+SHIFT+N [#515] - Compare window title to entry URLs [#556] - Implemented inline error messages [#162] - Ignore group expansion and other minor changes when making database "dirty" [#464] - Updated license and copyright information on souce files [#632] - Added contributors list to about dialog [#629]

jeisoncp · 2018-08-30T16:42:20Z

Would be great if we can use a diceware list in our mother language, like portuguese.

droidmonkey · 2018-08-30T17:39:51Z

You can change the eff_large.wordlist to whatever you want.

TheZ3ro · 2018-08-31T07:30:14Z

@jeisoncp even better, place your wordlist file in the wordlist/ folder for your KeePassXC installation and a DropDown button will appear for selecting the wordlist to use

jeisoncp · 2018-08-31T10:01:33Z

@TheZ3ro Great, thanks by the advice. Maybe this files could be placed in default installation.

TheZ3ro force-pushed the feature/new-password-generator branch from b289f99 to e9a075b Compare March 4, 2017 17:18

phoerious added the new feature label Mar 4, 2017

phoerious added this to the v2.2.0 milestone Mar 4, 2017

TheZ3ro mentioned this pull request Mar 4, 2017

Add support for high ANSI characters in the password generator #343

Closed

louib reviewed Mar 4, 2017

View reviewed changes

TheZ3ro force-pushed the feature/new-password-generator branch from b59854e to 4d547d3 Compare March 4, 2017 21:36

TheZ3ro mentioned this pull request Mar 7, 2017

Support for password generator profiles #19

Closed

TheZ3ro force-pushed the feature/new-password-generator branch from 4d547d3 to 1137a9e Compare March 8, 2017 15:22

droidmonkey approved these changes Mar 10, 2017

View reviewed changes

TheZ3ro force-pushed the feature/new-password-generator branch from ea970bd to c8b8e97 Compare March 16, 2017 22:54

phoerious requested changes Mar 16, 2017

View reviewed changes

TheZ3ro force-pushed the feature/new-password-generator branch from c8b8e97 to 30cfb16 Compare March 16, 2017 23:13

TheZ3ro changed the title ~~WIP: New Diceware passphrase generator~~ New Diceware passphrase generator Mar 17, 2017

louib reviewed Mar 21, 2017

View reviewed changes

src/core/PassphraseGenerator.cpp Outdated

}

void PassphraseGenerator::setWordlist(QString path)

Copy link

Member

louib Mar 21, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@TheZ3ro setWordList?

TheZ3ro added 12 commits March 22, 2017 00:00

New Diceware passphrase generator, close #21

d9ccde9

Add diceware tests

be9bd16

fix wordCount instead of length

98e2c31

add underscore as separator

67c6e10

fix wordlist file install

0ba19cc

remove short wordlists

044feea

permit only wordcount > 0

1d32695

hide comboBoxWordList if only one worlist present

b6a7771

some UI fix

7541f57

let every string as separator

8937647

change button position

19d1fa8

fix camel case

0c75584

TheZ3ro force-pushed the feature/new-password-generator branch from f4451ab to 0c75584 Compare March 21, 2017 23:05

louib approved these changes Mar 22, 2017

View reviewed changes

TheZ3ro requested a review from phoerious April 1, 2017 12:17

phoerious approved these changes Apr 9, 2017

View reviewed changes

droidmonkey merged commit 5696178 into develop Apr 9, 2017

droidmonkey deleted the feature/new-password-generator branch April 9, 2017 16:36

phoerious added pr: new feature Pull request that adds a new feature and removed new feature labels Nov 22, 2024

New Diceware passphrase generator #373

New Diceware passphrase generator #373

Conversation

TheZ3ro commented Mar 4, 2017 • edited Loading

Description

How Has This Been Tested?

Screenshots (if appropriate):

Types of changes

Checklist:

louib Mar 4, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

phoerious Mar 4, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

louib Mar 4, 2017 • edited Loading

Choose a reason for hiding this comment

TheZ3ro commented Mar 4, 2017

louib commented Mar 4, 2017

TheZ3ro commented Mar 4, 2017

louib commented Mar 5, 2017

J-J-Chiarella commented Mar 7, 2017

TheZ3ro commented Mar 7, 2017

TheZ3ro commented Mar 8, 2017

phoerious left a comment • edited Loading

Choose a reason for hiding this comment

phoerious commented Mar 16, 2017 • edited by TheZ3ro Loading

TheZ3ro commented Mar 17, 2017

Choose a reason for hiding this comment

TheZ3ro commented Mar 21, 2017

louib commented Mar 28, 2017

droidmonkey commented Apr 9, 2017

davad commented Apr 17, 2017

jeisoncp commented Aug 30, 2018

droidmonkey commented Aug 30, 2018 • edited Loading

TheZ3ro commented Aug 31, 2018

jeisoncp commented Aug 31, 2018

TheZ3ro commented Mar 4, 2017 •

edited

Loading

louib Mar 4, 2017 •

edited

Loading

phoerious Mar 4, 2017 •

edited

Loading

louib Mar 4, 2017 •

edited

Loading

phoerious left a comment •

edited

Loading

phoerious commented Mar 16, 2017 •

edited by TheZ3ro

Loading

droidmonkey commented Aug 30, 2018 •

edited

Loading