Repository navigation
persistent-setup: warn instead of forcing reboot on weak passphrases - #292
Conversation
Stripping spaces before keepassxc-cli estimate scored random-word passphrases as one concatenated token, so a five-word passphrase could fall below 50 bits and force a reboot. Keep the spaces, and let the lowest-score warning continue instead of rebooting unconditionally. Refs #243. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019JziKN4UP3pEXBVsdSYJDQ
|
Generated by Claude Code |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 53b9fcf792
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Scoring the passphrase with its spaces credited each separator as entropy, so four common words passed as 70 bits. Strip spaces again; random EFF-list passphrases of 6+ words still score above 65 bits, and the weakest case now warns instead of forcing a reboot. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019JziKN4UP3pEXBVsdSYJDQ
This comment has been minimized.
This comment has been minimized.
BenWestgate
changed the title
|
@codex review |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
2 participants
Requested by Ben · project thread
Before: if
keepassxc-cli estimatescored the existing Persistent Storage passphrase under 50 bits,persistent-setupshowed a warning with only a "Restart Now" button and rebooted. A 5-word BIP39-style passphrase (49.9 bits) hit this and could not get past setup.After: that warning offers "Continue Anyway" next to "Restart Now", with Restart as the default. Scores of 65 bits and up still pass silently, and the 50–65-bit warning is unchanged.
This is the "make the <50-bit case a warning rather than a forced reboot" half of the fix ACKed on #243, chosen over #289's approach of removing the check.
The other half, scoring the passphrase with its spaces, was tried in the first commit and reverted after review. The separators added about 30 bits:
correct horse battery staplewent from 47 to 70 bits and passed. Spaces are stripped again before scoring, as on master. Random phrases from KeePassXC's EFF large wordlist still score well with spaces stripped (40 samples each):How: the <50-bit
zenity --warningbecomes a--questionthat breaks out of the loop on Continue, matching the existing 50–65-bit dialog.Checks:
bash -nandshellcheckclean. Not run in a Tails VM.🤖 Generated with Claude Code
https://claude.ai/code/session_019JziKN4UP3pEXBVsdSYJDQ