‘DiceKeys’ creates a master password for life with one roll | Hacker News Reader

‘DiceKeys’ creates a master password for life with one roll

wired.com

81 pointsheadalgorithm86 comments

What's the benefit of this? You have to trust the website to faithfully scan the dice and not send their state anywhere else. If you trust the website, then you could just wiggle the mouse for entropy to seed a cryptographically-secure PRNG, generate a password in the usual way, and write the password down (or memorize it, or print it, or print it as a QR code if the scanning is important, etc.). That seems equally secure, and more convenient than carrying a set of dice with me everywhere I go.

And of course a YubiKey or equivalent is the real answer. I'm trusting the developer there too, but I get a nice compact package that fits on my keyring, and a secret that never goes outside that package.

> wiggle the mouse for entropy

You don't have contact info in your profile, would you mind shooting me an email at mouserng-hnpublic@lucgommans.nl? As far as I could find, there has been no research into the randomness of those key-generating mouse movements, so I'm slowly (over months, probably will be years in the end) collecting data to finally do this. Collecting a trace for me shouldn't take more than two minutes of your time. (Anyone else who's interested is also welcome to mail me, by the way. The address will work for at least the next 7 days.)

I agree that's an interesting and under-explored question. Perhaps you could gamify it, build a website where people compete to generate the maximum bits of entropy in ten seconds, as measured after compression by an algorithm that you continuously retrain and enhance based on that user data?

Yeah the plan is to eventually make it public, but for the moment I want to have a reasonable amount of data to make sure I'm capturing the right things. I mean, (x,y,time) is all there is to it, but perhaps I should be measuring it in some desktop software (where I might be able to capture the interrupts and their jitter) rather than just record the movements in javascript.

Well you don’t have to trust the website, you could fairly easily copy the dice’s contents to your password generating app yourself.

I like the physical nature of it. Cryptography is so abstract. I like idea of master password generating code device being a physical object.

The idea is neat, but it seems like a horrendous idea to get your disk encryption keys from something you liked because of the aesthetic!

I guess I see the appeal in that sense. It's a bad practical device, but a good security-themed desk toy. (Though for the latter, I'd prefer a combination Enigma/watch for TOTP?)

The physical route is a good idea, but if you're going to do it there's no reason to introduce a weak link in the chain of having an app scan the dice. You can just get a set of 5 dice and do the lookups yourself using a word list like this [0].

[0] https://www.eff.org/deeplinks/2016/07/new-wordlists-random-p...

The author of that post is on the DiceKeys advisory board.

At some point, you're going to feed the entropy source into software. Having the app be part of your trusted computing base reduces the chance of a data-entry error that could leave users forever without their data.

Feeding the entropy source into software might take many different forms depending what is the password to (e.g. login/full disk encryption key on your computer, password manager master password, password to a specific online service, etc). For most uses you'll have to enter it as text, and have to enter it multiple times, potentially on different devices that you are accessing the service on.

For almost any real-world use case, memorizing the password and typing it in on a keyboard is pretty much a necessity. There are many kinds of inputs that don't allow another software like DiceKeys to enter the secret, so I'd still definitely rather stick with the simpler, human-readable option.

You could also just get some random dice, including ones with letters, and generate a password directly from that without going the word-lookup route.

I'm probably an outlier, because I already have random dice, but "right leg squshr december 46 monday" seems secure enough to me: https://i.imgur.com/JGh4fik.jpg

Assuming someone knows you used those dice, but doesn't know the order you arranged them in, and assuming that the d6's with the letters on them are not identical, I think you've got 55 bits of entropy there [1]. That's equivalent to between an 8 character and 9 character password of ASCII non-whitespace printing characters.

Password crack time estimator sites are giving me times ranging from a few months to a few centuries to brute force it. Probably OK but I'd personally want something a bit better for a master password.

[1] 12 x 6^6 x 12 x 6^2 x 7 x 11! / 2. The first 5 factors come from the individual dice, the 11! covers order, and the divide by 2 comes from the two numeric d6 being interchangeable so order does not matter for them.

> Assuming someone knows you used those dice

Under that assumption, yup. But naturally, if you were really going to do this, you wouldn't tell anyone which dice you used, or that you even used dice to generate the password. Ideally you'd probably use even more dice.

Of course, diceware is meant to use something most people can get their hands on easily; a day-of-week die, etc., isn't something you're going to find in a common game set.

This is not a replacement for YubiKey, this is a system to back them up. The article says: "You can then use that key [...] as the seed to create a U2F key for two-factor authentication"

Imagine that you do not trust electronics. Maybe once in the past, your PC's power supply blew up and fried every device in every USB port. Or maybe you were by the ocean once, and salt water got into your pocket and ruined every electronic device there. Or maybe you have read too much science fiction and are super afraid of terrorists setting of EMP bombs.

Either way, you want a key backup which is non-electronic in nature. What are you options then? Not many. You can generate a random QR code and and print it. Or you can write down list of 13 random words, bitcoin-style. But this is still paper, so it can get lost or easily destroyed. The box of dice, on the other hand, is much bigger (so it is harder to lose), and much stronger physically -- it does not care about water damage or mold.

Yes, this is not for everyone. Some people will want to backup using another electronic device, or maybe they do not care about backups at all. I'd personally use the "13 words" method if I had this problem. But I can easily imagine a person for whom the dicekeys would be the best secret backup solution.

Maybe, though that seems pretty fringe to me. I'd note that backing up the secret from a challenge/response token creates a big new class of attacks--it's much easier for someone to learn my secret without me realizing when that secret exists outside tamper-resistant memory. It would be better to register multiple different security tokens, or to program multiple security tokens identically and then destroy the key material afterwards (except for the copies inside the tokens).

BTW, fully agree about that having to trust the website is pretty bad.

Hopefully they'll release open-source scanner ASAP.

> You have to trust the website to faithfully scan the dice and not send their state anywhere else.

no, you don't. a) it's open source b) it runs locally

so, yes, you have to trust the software to some degree but at least you can audit it and it _should_ be relatively small amount of code. Also, you don't need to trust any remote site or the network because it doesn't use those and that's easy to test without looking at any code.

You can't audit most password managers and even if you could it would be a pain in the butt because they're so much more complicated.

> And of course a YubiKey or equivalent is the real answer.

as others have pointed out this is used to seed the FIDO2 key which makes it _better_ than yubikey because you can't really replace a lost yubikey.

They promise open source in future, but for now it's just megabytes of JavaScript delivered by their website, much of it generated by emscripten and not human-readable. In any case, they're encouraging people to use the website now. Given that encouragement, I'd expect most people to use the dice through the website, even if/when a standalone app becomes available. Even if/when you had the source, this would be orders of magnitude more effort to audit than a simple PRNG-based password generator.

KeePass is actually open-source now, and has been audited professionally. You are correct that a full password manager is more complicated than the dice; but the dice don't replace your password manager, so it's an addition to your attack surface, not a replacement.

And no, storing your secret outside the the tamper-resistant memory of a security token isn't better than registering a second (or third, or fourth, or however many makes you comfortable) backup token. HSMs and security tokens exist for good reason, and a cleartext backup loses that benefit.

I don't see anything wrong with marketing this as a cool toy, and as a tool to teach people how computer security works. I'm disturbed to see this marketed as if it solves a real problem, since that's at best a distraction from the steps (e.g., using a password manager and a hardware security token) that will help people practically.

Ok, but still, since you’re trusting the app why not have it generate entropy by mouse movement? I imagine that’d be just as unguessable.

Ok, so how do you backup your mouse movements?

By memorizing it as a passphrase, or writing it down, or printing it as a QR code, or saving it to a flash drive, or (best) saving it in the tamper-resistant memory of a security token protected by a PIN or biometric? Unprompted, I don't believe many people asked for the most practical way to securely store 192 bits would answer "the orientations of twenty-five cubical dice in a plastic box".

It's a really clever idea with technical merit. More practical than the old lava lamp CRNG. It's an entropy source, and I think there are an infinite number of possible variations on what I'm calling "entropy rituals," which may or may not generate a sufficiently large field that mitigates brute force attacks.

In its favour, good, exogenous entropy mitigates part of post-hoc decryption attacks and wrecks the economics of passive bulk interception and surveillance. It means that threat actor needs to a) use direct attacks on user endpoints, b) sabotage algorithm implementations to truncate keys or c) bias the entropy source with loaded dice (because everybody knows...) or longshot d) use a TAO-like operation to add dice with duplicate facets from other cubes to dice kits in transit to reduce the total field size, which would be easily discoverable, but chalked up to a "printing error."

So at first glance, this is vaguely like Diceware, you just don't stop "playing"?

http://world.std.com/~reinhold/dicewarefaq.html

It's not the only option if you don't like a master password.

I use passwordless (GPG keys on an Yubikey) with a PIN code. The PIN can even be replaced by biometric soon. This is the way forward IMO. No more passwords at all, even master ones. If you turn on the tap-to-sign function on the yubikey you can also protect yourself from malware 'milking' your entire password database while the key is inserted. Of course I create the secrets on-key as is best practice.

Of course losing the token is an issue, but I have multiple and each password is encrypted against each of them.

I like this idea though. But I don't like that anyone who has a picture of the dice can generate the passwords. And I don't like leaving my password managers logged in all the time. It wouldn't work for my desired level of security, though I can imagine users who do leave their PW managers logged in, would be happy with it.

> No more passwords at all, even master ones.

Then... how do you prove you're you? And not merely someone who has your physical body in their possession?

Edit: Obligatory "biometrics are usernames, not passwords."

passwords don't prove you're you either. They just prove you're someone or something that knows the appropriate password.

Yeah but if you're reasonably good with security, they at least prove you were conscious and present when someone logged in.

No they don’t. See “rubber hose cryptography”, shoulder-surfing, hidden cameras, keystroke loggers, phishing.

I like the idea of this, however I do not like that you are expected to keep the master key in your drawer somewhere. It’s like writing your master password on a sticky note and putting it in a drawer.

I know there is always a risk of forgetting your master password but keeping it only in your brain gives you the most protection. I suspect law enforcement would have an easier time compelling you to give up your DiceKey object than forcing you to repeat your brain key. However I am not a lawyer and would be interested to hear more from those who know more about this kind of situation.

If you spill it on accident on your way to surrender it, it would be really unfortunate.

Unfortunately destruction of evidence is a crime which could aid the prosecutions arguments for consciousness of guilt and in the worth case tack on a new charge. I believe the jury could also be instructed to assume the worst in cases where evidence is destroyed.

Most unfortunate. :(

The current DiceKeys box has latches to make sure it's very very hard to open accidentally or if dropped from human heights.

We have thought about designing a box that's intentionally very easy to open for people who want to encrypt their laptop when traveling into a jurisdiction that may want to steal IP or compromise their journalistic sources. We'd want the user to be able to slip their hand into their pocket and release the dice from the box before anyone knows to ask for their DiceKey.

> I suspect law enforcement would have an easier time compelling you to give up your DiceKey object than forcing you to repeat your brain key.

Yes, at least in the US. There's good case law backing up the legal doctrine that the 5th amendment applies concerning anything known or memorized -- but that with a warrant, law enforcement can search a premises and seize items described by the warrant.

IANAL, but one can still serve time (up to 18 months) for contempt of court as I understand it -

https://arstechnica.com/tech-policy/2020/02/man-who-refused-...

> It’s like writing your master password on a sticky note and putting it in a drawer.

People should do this, and people should stop telling other people it's bad security to do this. And then people should stop using password managers.

The idea that the sticky note is bad is hilariously old school, and the result has been everyone putting their passwords in cloud-stored apps instead, which is 10,000% worse than a sticky note.

Remember: If it's on the Internet, your potential attacker is "every human on earth". If it's on a sticky note, your potential attacker is "everyone who can get access to the physical place you keep it". The former will always be an increasing number of billions of Internet users. The latter can be reduced to one or two if you store your sticky note somewhere very secure, like a safe or security deposit box.

Also, for added security... just lie on your sticky note. It doesn't have to be a high entropy lie to befuddle people.

But you have to agree that memorizing your password is more secure than writing it down.

Of course. But not everyone is good at that.

correct battery horse staple, but longer and sensible but still unique, and optionally without space.

Make up a sentence that makes sense to you, and remove all the spaces, use all lowercase and no special characters.

Forgettable: 5uP3r53kr17P455w00r[)!!11One

Memorable: ilikestartrekandhamandbeans

I used to have full-disk encryption on one of my machines using a password of the forgettable kind. But then the machine had an uptime of months until a power outage, and I realized that while I was fairly sure of the sentence I had no possibility of remembering all of the uppercase and lowercase and symbol and number substitutions. I lost quite a bit of data that day.

After that I began using a sentence that makes sense to me but which is not from a book or anything like that for the FDE on my desktop and external hard drives, and I use the pass phrase frequently. Simplicity and repetition is the key to remember your master password.

As for websites I use a password manager, and I sometimes generate passwords with my own diceware software https://github.com/ctsrc/Pgen but most often I am on my phone or on my laptop and then I use the password generator of the password manager that comes with those Apple devices.

I haven’t lost any more data since switching to managing my data encryption and my passwords this way.

Encryption is a thing. If we can’t trust encrypted data then security the password is worthless anyway as everything is owned.

This is why password managers are generally considered secure. They store only client side encrypted blobs and do not store or know your master password.

Like you, I have no concerns with storing your master password on paper in a locked drawer or something, but it’s unrealistic to securely store post its for every password you need as well as have them readily accessible.

Readily accessible to you is readily accessible to hackers. People should re-evaluate how many things they must have access to everywhere they go.

For example, my 2FA tokens are backed up in physical storage. This means if I'm traveling and I lose my phone, I don't have access to them until I get back. But that's a lot safer than leaving them somewhere others can access them too.

Hackers don’t have quantum computers to crack my password vault.

I’m using 1Password and it encrypts the payloads before they are shipped to the cloud. How does that compromise my passwords?

This, of course, is the correct answer.

This is pretty cool. But you do need to trust their website and app, and your scanning device.

Also, the website says you get about 192 bits of entropy. It's been a while since I did any combinatorics. It seems you should have 25! * ((6 * 4) ^ 25) possible dice rolls. 25! combinations of dice placement times (6 face up possibilities * 4 rotational possibilities) for 25 dice.

Python gives:

import math math.factorial(25) * (6 * 4)^25

496508538648719564809316402287439226010265627463254016000000

2^196

100433627766186892221372630771322662657637687111424552206336

They divide by four as there's a "canonical" direction to read the dice. See "Security Strength" at https://dicekeys.com/

Correct. We believe a two-bit reduction in strength is a small price to pay to ensure you get the same key even if you scan the box at a different orientation (e.g. up-side down).

We could have designed the software to try to recognize the top of the box, but the box for the steel version may look very different (or not be what you'd think of as a box at all.)

I just use 1337-speak versions of lyrics from bands I like that vaguely remind me of the subject matter for whatever I'm using the password for. I can't forget a password because I don't actually have to remember them, just be able to derive them using my personal ruleset. Excepting where data breaches or security policy forced a change, I haven't had to reset a password in over a decade.

Rules like that lower the entropy orders of magnitude compared to the truly random processes described in this article. Probably still enough entropy to give you good protection, but maybe not enough from a motivated nation state or multination corp.

Surely a box with some plastique cubes in it will protect you from these nation states.

It's not like they're buying a $5 wrench or anything.

Sometimes there is value is cracking someone’s password without them knowing.

In the end there's a password strength ceiling, and that ceiling is the moment it becomes harder for someone to crack your password than it is for them to pay someone else to come threaten/beat you into giving them access. Anything stronger than that is just security theater. Heck, even if you assume your opponent is mostly law-abiding the password ceiling is however many dollars it takes to set a bounty that results in someone finding a 0-day for the platform for which they want your access.

This is cute and might work around the house, but I wouldn’t entrust anything serious to it. As soon as your traveling and don’t have it, or your kids rearrange it, or someone else gets a picture of it, then it the novelty is definitely gone.

You could just as easily use a deck of playing cards or to construct a password and it would have exactly the same issues.

Yubikeys win the day again and again, I just more sites support them. The financial sites that would benefit most are still stuck on easily spoofed SMS authentication - if they even have that.

The site [1] of the app is quite simple. Actually it's refreshing to see such minimalism :)

----------

[1] https://dicekeys.app/

For the adventurous, see the page source!

And take a look at the 4.8MB javascript file.

I'm assuming that's due to needing both crypto polyfills and opencv?

OpenCV, but for crypto we use an open-source crypto library built on top of lib-sodium.

https://github.com/dicekeys/seeded-crypto-js

And you will also soon be able to read the source at

https://github.com/dicekeys/dicekeys-webapp

We're just figuring out whether to use an MIT license or a license that forbids use in stalkerware applications and anti-citizen surveillance applications.

Some of our code is already public at https://github.com/dicekeys

(We welcome contributors)

What they need with this is a human computable function that can take a short nonce and combine it with the arrangement of rolled dice to produce a secret value. This eliminates the problem of the trusted scanner. It also allows the same dice arrangement to be used for different services. If you are ever at risk of compromise, just simply discard the dice.

And if you can demonstrate that there are functions are computable by a user community that would benefit from them, it would make a fantastic submission to the Symposium on Usable Privacy and Security (SOUPS).

But, most people are trusting software at some point. We're making sure our software is small and relatively simple so that you can audit it. That's one of the reasons why we don't take dependencies on Google's Tessearact OCR engine, or on frameworks like React. (The one big dependency we haven't removed is OpenCV.)

One of my concerns would be durability of the software over time. In 20 years from now, will the site still be running? Will I need to hunt down old hardware or dependencies to regenerate my key?

The mapping seems pretty straight forward, I don't see why it couldn't be manually done.

You can, in fact, do it manually. T4r means letter T, digit 4, facing right. The directions are 't', 'r', 'b', 'l' (top, right, bottom left), which makes for a mnemonic you can follow with "right here in river city".)

Before you transcribe, just rotate the box so that the first letter in the alphabet appears in the top left, than read in English order (left to right, then top to bottom).

The crypto library: cpp: https://github.com/dicekeys/seeded-crypto ts/js: https://github.com/dicekeys/seeded-crypto-js

Neat! Thanks for sharing.

This isn't a whole lot different than `cat /dev/urandom | base64 | head -c 33`, printing it out, and laminating it.

The difference here is that there is virtually no way for there to be a bug, virus, malware, keylogger, etc that might break the true randomness of the dice roll where all those are a possibility for the computer generated version.

I feel that the risk of my /dev/random being broken is much lower than some random website being intercepted or assimilated.

The website is just an easy way to transfer the random numbers to your computer (which you arguably shouldn’t use if you need something like this.) The actual randomness generation is the dice roll, which is less likely to be broken than your /dev/random (which is probably not broken and totally fine to use)

I’m not comparing my /dev/random to my dice roll. I’m comparing the likelyhood of my /dev/random being broken to the likelyhood of the website being intercepted or assimilated when I use it.

Doesn't a large portion of computer security rely on private keys derived through computational "dice rolls" anyway?

If RNGs are that broken, the whole internet is broken- breaking a few passwords would be kind of secondary, wouldn't it? First up would be certain Bitcoin wallets, etc.

But what do you do with this key, once you made it? You scan it.

And now there a simple way for "a bug, virus, malware, keylogger, etc" to steal all of your secrets.

WTH - why would they use a shitty plastic box to hold them? Drop the box, dice fall out, lose access to all your secrets?

No worries my friend, I will sell you some hot glue to keep those dice in place. I'm working on the Kickstarter for it as we speak!

Just take a pic with your phone. Nobody will have a clue what it's for.

> It's "toddler-proof,"

Not a parent, but this is one of the first things I thought of.

At the very least it's a really cool talking point and way to lead into crypto, esp. when talking to kids about it. And some cool dice ;)

I love supporting small security initiatives like this to bring more attention to these cool concepts. Ordered the two dice sets and four keys.

So you roll the dice and then leave them in the case and never roll them again?

If you want to be able to recover _that_ key at some point.

Add some clear casting epoxy and it would be a cool project to show all your friends. Oh wait.

Or just roll the dice, take a picture of the dice, sell the dice...

https://dicekeys.com/ may be more useful than the paywalled article.

I feel like his t-shirt is on backwards in the video. Does that add to the geek cred?

It's my daughter's shirt. She didn't approve of any of my shirts. The front has Bugs Bunny.

Reply on news.ycombinator.com