Diceware

I'm a big believer in Diceware, which involves physically rolling dice to generate passwords. However, since part of my $DAYJOB involves managing hundreds of machines, I found myself generating a LOT of passwords, and I kept running into the same problems, over and over.

It takes time to look up the word for a given number combination.

Doing it five times in a row, a dozen times a day, gets really old.

The dicepass script below started as a tool to automate looking up the words corresponding to each number.

The word list is well known.

One of my cow-orkers pointed out that people who break passwords for a living, surely have the original Diceware word list in their password guessing systems, and that if I were to use a different word list, those automated password guessing systems would be useless.

Also, rather than rolling five six-sided dice (aka "5d6"), I decided to use four ten-sized dice (aka "4d10") and make a list of 10,000 words.

The act of rolling dice, makes noise.

My desk at $DAYJOB (this was before COVID) was in an office full of software developers (this was also part of my job as well) who needed to concentrate, and people were grumbling about the noise. These are people that I work with every day, so it was important to me that I not give them any reason to grumble.

I have a USB hardware random number generator, which I personally feel is "random enough" to trust when generating passwords, so I added an option to the script which lets it grab random numbers from the hardware device rather than needing me to roll dice.

So.

This is my dicepass script (written in Perl, with no module dependencies outside of the standard Perl distribution), along with the word list I created for "4d10".

Also, en.txt is the original list of words with frequency data that I started from. (I got the files a few years ago, from a site which has since moved to Github.) When I get some time I may add a section below explaining how I selected the words and created the words-4d10.txt file.

If you're using Keybase, the same files are in the /keybase/public/jms1/diceware/ directory. (Literally, the same files - the jms1.pub web site IS served from the /keybase/public/jms1/ directory.


Other useful information

Other word lists

EFF Word Lists - has lists for 5d6, 4d6, and 4d6 but only longer words. Also has a good explanation of why it's important to use "passphrases" instead of passwords, as well as why you should use a password manager (such as 1Password). (Full disclosure: I have been an EFF member for several years.)