nextcloud / desktop

💻 Desktop sync client for Nextcloud
https://nextcloud.com/install/#install-clients
GNU General Public License v2.0
2.97k stars 780 forks source link

Allow 12 words from multiple dictionaries before enabling e2e encryption #2450

Open sunjam opened 3 years ago

sunjam commented 3 years ago

This is a feature request for allowing users to provide their own 12 recovery words before enabling e2e on the desktop client. Allowing people to provide their own words opens up the ability for increased security by drawing from multiple languages and spellings, which could help mitigate future dictionary based attacks. Thanks for considering, and great work!

Zocker1999NET commented 3 years ago

Could be a great idea, but the feature should be limited by requiring long words or at least should be hidden, because otherwise users might tend to use weaker words than the random generator would use. I do not think that technical users might insert weaker words, but "normal users" might do, and the past showed that users will use weak passwords even if there are restrictions until the can choose their own passwords / passphrases. And IMO, using weak passwords in online systems might be bad but let the encryption rely on probably bad user-chosen passphrases will allow very easy offline attacks.

er-vin commented 3 years ago

I admit I'd have similar concerns to @Zocker1999NET

sunjam commented 3 years ago

If the concern is adding weak words then my request is to at least expand the number of available dictionaries beyond a single language so words can be from a number of different dictionaries: German, Latin, Spanish, Russian, Chinese, etc. If the concern is different keyboard layouts, perhaps that becomes the only limiting factor. Thanks for considering.