This was a weekend project that was forked from a project that I thought was nicely done but needed some improvements (https://github.com/yesiamben/diceware). Notably that project:
- uses the JavaScript Math.random() API which is known to not be cryptographically secure.
- is not served over an HTTPS connection.
- requires re-download of all files to change language.
- tracks all page views with Google Analytics
- leaked information about the users preferred language via a URL query string parameter.
- used inline script tags which make it incompatible with lockdown via a Content Security Policy.
So I remedied all of these issues and re-factored and modernized the code. The source of randomness is now the well supported window.crypto.getRandomValues() API which is cryptographically secure. It now also uses a fully Bootstrap based UI and provides password strength feedback using the excellent zxcvbn library from Dropbox (https://blogs.dropbox.com/tech/2012/04/zxcvbn-realistic-pass...). The application will now also fully work offline (including language switches). All of the code is signed (keybase.io GPG SIGNED.md) and can be verified and run locally by cloning the repository.
I hope you enjoy this. I submitted a pull request to the upstream repository as well but I have not heard back anything to date.
Comments
I am the author. The source code for this is available at:
https://github.com/grempe/diceware
Any bug reports are welcome.
This was a weekend project that was forked from a project that I thought was nicely done but needed some improvements (https://github.com/yesiamben/diceware). Notably that project:
- uses the JavaScript Math.random() API which is known to not be cryptographically secure. - is not served over an HTTPS connection. - requires re-download of all files to change language. - tracks all page views with Google Analytics - leaked information about the users preferred language via a URL query string parameter. - used inline script tags which make it incompatible with lockdown via a Content Security Policy.
So I remedied all of these issues and re-factored and modernized the code. The source of randomness is now the well supported window.crypto.getRandomValues() API which is cryptographically secure. It now also uses a fully Bootstrap based UI and provides password strength feedback using the excellent zxcvbn library from Dropbox (https://blogs.dropbox.com/tech/2012/04/zxcvbn-realistic-pass...). The application will now also fully work offline (including language switches). All of the code is signed (keybase.io GPG SIGNED.md) and can be verified and run locally by cloning the repository.
I hope you enjoy this. I submitted a pull request to the upstream repository as well but I have not heard back anything to date.