I use Diceware to generate passphrases, and am very happy with the ease of the process and the security of the results.
Where I have an issue is with the word list itself.
- It contains problematic words like "rape" and "negro" that I can't reasonably use in a passphrase I want to send to a third party.
- It contains many obscure words like "eagan" and "scurry" that are hard to remember how to spell.
- it contains things like "dx" and "vh" and "a&p" that aren't words at all. "a&p13fk93c'sy" is a valid Diceware passphrase that is just as hard to remember as a truly randomly generated password.
- It contains many very short words, so it is possible for a strong six-word Diceware password to only be 6 characters long.
Of course, you can re-run the generation process if you get a bad passphrase, but that reduces entropy.
Since rejecting unsuitable passphrases reduces the entropy, are there alternative word lists available, or is there some other strategy to ensure Diceware only generates useful passphrases?