<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title></title>
</head>
<body>
<div name="messageBodySection">
<div dir="auto">A riff off: <a href="https://en.wikipedia.org/wiki/Diceware" target="_blank">https://en.wikipedia.org/wiki/Diceware</a></div>
</div>
<div name="messageSignatureSection"><br />
<div class="matchFont">../Dave</div>
</div>
<div name="messageReplySection">On Aug 28, 2020, 11:15 AM -0400, Christopher Browne via talk <talk@gtalug.org>, wrote:<br />
<blockquote type="cite" style="border-left-color: grey; border-left-width: thin; border-left-style: solid; margin: 5px 5px;padding-left: 10px;">
<div dir="ltr">
<div>Here's a cool thing I saw recently...</div>
<div><br /></div>
<div><a href="https://www.schneier.com/blog/archives/2020/08/dicekeys.html">https://www.schneier.com/blog/archives/2020/08/dicekeys.html</a></div>
<div><br /></div>
<div>The intention of this parallels the various Bitcoin "Solid Steel Passphrase Wallet" items that were popular a year or so ago</div>
<div>(See <a href="https://www.toughgadget.com/bitcoin-crypto-metal-recovery-seed-wallets/">https://www.toughgadget.com/bitcoin-crypto-metal-recovery-seed-wallets/</a>, <a href="https://www.buybitcoinworldwide.com/wallets/steel/">https://www.buybitcoinworldwide.com/wallets/steel/</a> )</div>
<div><br /></div>
<div>It's a case for a set of 25 dice that looks like a Boggle game set; it will generate and "record" what ought to be a Sooper Seekrut key as would be used for things like:</div>
<div> - master key for password manager</div>
<div> - U2F key for 2 Factor Authentication</div>
<div> - Secret key for cryptocurrency wallet</div>
<div><br /></div>
<div>By being a set of dice with a nice plastic box to hold them securely, this is not vulnerable to various threats common to electronic devices:<br /></div>
<div> - EMP (for those highly worried about nuclear devices)</div>
<div> - Water damage</div>
<div><br /></div>
<div>Of course, if all your disk drives get toasted, there might not be any data left to decrypt or systems to connect to. And plastic will melt away or burn when exposed to fire...</div>
<div><br /></div>
<div>But it's pretty cool, I'm tempted to grab a set.</div>
<div><br /></div>
<div>There's a web app: <a href="https://dicekeys.app/">https://dicekeys.app/</a></div>
<div><br /></div>
<div>It appears that this application, embedded in a single JavaScript file, runs locally, inside your browser, so that usual criticisms about it being a giant security vulnerability of sharing your key with their web site seems like it mightn't apply. How to confirm in an authoritative way that nothing is *actually* shared seems like the fun security question. <br /></div>
--<br />
<div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature">When confronted by a difficult problem, solve it by reducing it to the<br />
question, "How would the Lone Ranger handle this?"<br /></div>
</div>
---<br />
Post to this mailing list talk@gtalug.org<br />
Unsubscribe from this mailing list https://gtalug.org/mailman/listinfo/talk<br /></blockquote>
</div>
</body>
</html>