Let user choose recovery code words

[n8pwr]

Feature request: Let the user choose their own 12 word recovery code.

[grote]

We intentionally don't let the user choose, to ensure that the words are properly randomized.

[wehkah]

Yesterday, I came up with the same idea and I would like to give some new points of view to this discussion:

1. If the users can choose the 12 words themselves, especially in their own languages¹, they are much less likely to forget them. (¹ See my comment here..)
2. If you let the users choose the words, they can easily make a complete sentence out of of these 12 words or a short story in their mind that will help them to remember.
3. If someone has access to a backup media, and it is known that the passphrase consists of just 12 regular words that can be found in any dictionary of just one language, cracking this "passphrase" won't take very long. So it doesn't really matter if these words were chosen by the app or by the users.
4. If you let the users choose their words, they can insert special characters, numbers, punctuations, as they like it and as they can remember it.
5. Some users will use USB devices to store their backups, and they will not carry these storage devices with them all the time. For a USB storage, that never leaves the privacy of your home, the existing password policy of SV is very inconvenient and I can imagine this being a reason why many users don't make backups at all. For example: this is the reason, why I use adb to make backups, which are stored on a LUKS partition on my pc, which is far more convenient to my than the existing SV policy.

So, these are my points view. Any comments on them?

[t-m-w]

I definitely understand the convenience of being able to choose your own words/sentences, but sadly I suspect it may have negative security implications for users who struggle to choose good passphrases (which I would anecdotally argue is most users) or who may frequently reuse them, and allowing arbitrary recovery phrases could even make them harder to remember because you lose out on per-word suggestions and verification; if a word was entered incorrectly, this couldn't be known.

As pointed out in my other comment, Seedvault uses BIP39, a preexisting passphrase mechanism targeted at securing cryptographic wallets. Point 3 above is fortunately not accurate. Careful thought was put into BIP39's design to ensure it is difficult to crack and would indeed take a very long time. The spec page linked previously goes into more detail.

If this was going to be implemented, it would be better as a discouraged advanced option with many warnings, but I'm not seeing a huge upside for most users vs the downsides, since users would gravitate toward it for convenience and potentially risk the security of highly-sensitive data.

[grote]

This doesn't address: #348 (comment)

[t-m-w]

Right. Proper randomness couldn't be guaranteed if this was implemented at all. That's what I mean: users tend to struggle to choose or use good passphrases (sufficiently-random ones).