Topic: How to create strong passwords using Diceware (Read 341 times)

I never create personal passwords using third-party applications. I prefer to randomize passwords of my own accord.

Actually not only passwords that must be secure and have random passwords, but device security also needs to be considered.

With just a piece of paper and it has been remembered in my mind the password will remain safe and certainly not involved with any application. There are many ways you can do to strengthen a password with a unique password. It remains only to choose which one is suitable and the safest.

I mentioned it in the post you quoted.

A manipulated RNG could reduce the keyspace to a number small enough to be bruteforced by the creator of the website.
If "bad" libraries are used, a malicious developer might either have included a vulnerability (small keyspace) or a coding error might have happened.


Just because you are running something offline, it doesn't make it secure.

the code that you can't see can be malicious and give you pre-generated passwords (or simply generate them deterministically) which seems random to you. that is why downloading a website and using that offline doesn't do anything.

if you want to create passwords using some password generator tool, it must be an open source software with sufficient popularity (so that the code is reviewed and doesn't have bugs) and it must be used on an air-gap computer. keep in mind that air-gap is not just about being offline but being on a clean system that is cut off from any type of communication.

I mean without Internet your passwords won't be transferred anywhere, what can happen?

These is basically the first time I’m hearing about Diceware or any software that enables the creation of streng password. Nevertheless these information is essential to us. We are in a platform where the need for strong passwords is important and considering bitcoin being digital and anonymous currency it’s important for one to have a strong password to keep all bitcoin wallet safe. A lot of people most times find it difficult to create strong and easy to remember password but I believe with these software it’s would be now easier for them to generate strong password.

Is there a reason we need another password thread?
We have tons of them already, and the majority of them are better than this one.



I would not recommend this.
This is extremely careless and dangerous.

You should never use any online service to create passwords and/or private keys.
And downloading the website does nothing. Without verifying the (hopefully open source) code, you will never know whether the website is using safe code (no manipulated RNG, trusted libraries, etc..).

You can say its no need to care, but its need some rules
1. That website not realted woth your asset
2. You put fake identity when register
3. Just for testing
4. Account information (email and password) not used for important service), etc

I think it will different if the website contains your real data, real identity (at least name, email and phone number), even not an exchange site. If it contains real data, you must thinking about the risk about stolen your sensitive data.

I know it, almost my password is similar. I just care about 1 main account to secure that is Email, and I set up 2FA for it.
With accounts on an exchange I always set up 2-factor authentication codes. As for other websites, there is really no need to care.

I do not trust Diceware or any other software to generate passwords or store them, for example Roboform, Password Recovery Tool... Any Autofill service is vulnerable, simply no one has found it yet.
It's best to keep the passwords in your own mind.

I agree with you. These programs are useful for those people who have huge amounts of money in their accounts, and they are of interest to a cracker, but it is necessary to correctly use such software together with other components. After all, a strong password is not a guarantee that you will not be hacked.  It is necessary to correctly save it. Too much paranoia isn't a good thing either. If you are too afraid of something, it certainly happens.

Several simple rules boil down to one thing, you need to constantly monitor all the news on security on the network.
Sometimes our reliable antivirus can fail, just as there can be a failure in one of the programs that we trusted everything personally.
No matter how funny it may be, sometimes passwords, the most reliable, are simply stolen from people by hackers when accessing computers.
Therefore, it is necessary to work in a complex: safety and care when working with your data.

I can confirm this statement myself because I have lost my account in some local community and other sites by forgetting those passwords. Yeah! we cannot rely on our memories with this one. The only way we can save those multiple passwords is to make a hard copy of documents where we will keep it safe and make some effort to hide it somewhere safe.

This is also me before, I really don't uses some services or applications for password, just like password generators or password manager.
But as time goes by, a lot of accounts I have over the internet especially when my work is already needed a lot of accounts for different websites that needs to be access immediately, so here come some password managers.
It may scary, yes I admit, but for me, it's the way to be more comfortable and convientent way to access our accounts when we needed them in a quick way.

If you plan on relying on your memory then that is a bad idea. While the password is easy to remember you probably can't recall 10 different combinations or so after a few months, and only one or two will stick in your head. Not to mention whether you can what is the right password for A or B site.

That is true but the brute forcing of passwords only begins when the password hashes are stolen, and on the Diceware site I linked it gives you estimates to how long it will take for different numbers of words to be cracked. Longer words take centuries and millennia to crack so mathematically speaking the hackers are wasting their time and utility bills.

Still I recommend that even diceware passwords be changed if you hear that a service has been breached.


That's what I mentioned in #2, using text-to-speech to make the computer speak the passphrase to you, provided that you're in an empty building of course.


The good thing about diceware is that you can also make them without a computer. Just print the list of words from https://theworld.com/%7Ereinhold/diceware.wordlist.asc, get a physical dice and roll it five times to construct a word. Do this for as many words you need to generate. No technology required.

As for me personally, I never use any services or applications that allow you to generate random passwords. I have no quite of confidence in their algorithms, because as far as I remember, there were a couple of cases when these algorithms turned out to be not so random.

Usually, when I need to create a complex, long and fairly random password, I use the old method - I randomly type different characters on the computer keyboard using different registers, and then manually add a few additional mathematical symbols.

Considering that the length of the passwords that I create in this way (if the service interface in which I register allows it) is not less than 40-45 characters, I think this method is quite reliable. Moreover, you do not have to rely on anyone other than yourself in this matter.

I do not think that the problem with creating a random password is the amount of trying to remember it, and the strong word does not mean anything if you want to use it on a central server or central service where it can be hacked at any time.

If there was a way to create a random password and simplify the way to remember it without the need for any third party (it is only saved in the brain) it would be perfect.

I use password safe android (different app than above comment mentioned), it's offline and you can make encrypted backups.

I don't use Diceware so I can not make a comment on it. To supply your topic, you can consider the [GUIDE] How to Create a Strong/Secure Password of GreatArkansas.

KeePass: https://keepass.info/
KeePassDroid: https://play.google.com/store/apps/details?hl=en&id=com.android.keepass
PwSafe.org: https://pwsafe.org/

https://protonmail.com/blog/protonmail-com-blog-password-vs-passphrase/
https://tonyarcieri.com/4-fatal-flaws-in-deterministic-password-managers

Simple check how strong the password by using tool https://lowe.github.io/tryzxcvbn/
example:

Most people use very short passwords to protect their accounts. We're talking either ridiculously easy to guess passwords, like "password", or words found in a dictionary, which may or may not have numbers at the end. These passwords can be broken easily by criminals who can rent enough computing power. To them it doesn't matter how hard it is for us to remember our passwords, all passwords that have a short enough length can be broken by them.

In this day and age when services getting breached left and right, you wonder how best to protect yourself. Contrary to what experts say, two factor authentication is not secure enough to entrust your personal details in (SIM swap scams are the reason why), so the only reasonable alternative is to use extremely long passwords that will take infeasible amounts of time to crack. The question is, how are you supposed to remember a password that long in your head? You can't be expected to remember something like d7498323ace9137c1e0e9cdf1f955b78, can you?

But what if the password was actually a passphrase with dictionary words in it separated by spaces?

That is what's called a Diceware passphrase. Diceware takes a random selection of words from a list, and puts them together. The selection either comes from a secure random number generator, or physical entropy like coin flips or dice rolls. Diceware passwords can also be constructed entirely without computers. Print a list of words, roll a dice a few times and put the numbers together to pick a word for the list, and repeat as many times as you want to get additional words. Here's an XKCD comic describing how easier they are to remember compared to regular passwords:

---

There is an online service that can generate these passwords for you without ever sending them across the internet, in other words the selection process is entirely done locally (for the paranoid out there: this page can be downloaded and run locally).

This is the website: https://www.rempe.us/diceware/#eff, it lets you create a sequence of 5 to 8 words by default, but it also has buttons for adding special characters and more words at the end. This is useful for services that insist you have special characters, numbers and uppercase letters in your password, but currently this tool doesn't generate numbers or uppercase letters, but since this tool is open-source, anyone can implement this support in the future. Then it would be the ultimate solution for all services that don't have a maximum password length. The ones that do have one are likely running ancient authentication software. Banks immediately come to mind.

You can verify that the page doesn't transmit your passwords by opening the browser's DevTools, go to the network tab, and generate some passwords, noticing that there are no network requests made.

But to be extra safe (the site could get hijacked at any time), you should clone this page from github using git clone https://github.com/grempe/diceware.git (or just download the zip file), navigate into the folder, and run the page on localhost as it won't work correctly if you open index.html directly:


This post is supposed to be for the average layman and not for the computer scientist, so measurements of cracking speed and hashes/second will be entirely omitted here. The good news is, the number of words your diceware passphrase has roughly correlates to how strong it is:


Everyone reading this should be using at least 7 word Diceware for their wallet passwords.

How to remember your passphrase

I promised that this method would be easier to remember than a standard passphrase. Well, a bunch of words aren't easily remembered at first, so how do you go about this: There are two different ways you can use to remember it, you are free to use both:

1. Writing it down

Now before everyone comes at me with pitchforks and torches for suggesting this, it's important to understand that writing the passphrase on a piece of paper, and storing that paper somewhere safe like in a wallet where your credit card is, or in a locked box or drawer, or simply in an obscure place in your room that you don't share with anyone, is safer than keeping it in your head. You might forget the passphrase one day, and lose access to your account. The objective in writing down your passphrase is to assist you in remembering it in your head, so that it's stored in two places: One place that you guard, the other that's physically impossible to access (your head). In fact writing it down is the recommended way of saving seed phrases as well, which is more important than a password.

People who don't write down their passwords usually end up forgetting them and using weaker passwords instead, undermining the entire purpose of Diceware.

2. Make the computer speak it

This method is one I use to register the passphrases in my head. Since the passphrase consists entirely of English dictionary words, the computer should have no problem with speaking them. You can use software like Microsoft Narrator, MacOS VoiceOver, or espeak on Linux (you may need to install it with your package manager first) with the following command:


Warning: never type passwords directly into commands because they will be saved in bash history.

The voice will help you remember some of the words, you can also experiment with changing the voice, pitch or speed to remember the rest of the words.

---

More information about diceware for those who are interested: https://theworld.com/~reinhold/diceware.html