Is this password generator safe?

Question

128-bit entropy is required

http://nxtra.org/nxt-client/js/passphrasegenerator.js

With all new browsers (Chrome, Firefox, IE 11) it uses crypto.getRandomValues which should be safe, but with IE 10 (and older) it uses random mouse input from the user combined with Math.random

$("html").on("mousemove", function(e) {
            var seed = [e.pageX, e.pageY, +new Date];
            PassPhraseGenerator.push(seed);

How safe is that second part?

Answer 1

In on itself it should be fairly secure as a concept, but generally speaking one should not rely on JavaScript for any kind of security. It's trivially easy to do injections and interceptions on any JavaScript code and doing complex math in JavaScript can easily trigger 'stop script' or any other browser script sanity checks so developers tend to either lower the security as much as possible or to downright break any convention just so their 'secure page' can work - which in turn leads to all kinds of problems.

But putting that aside, there are two potential problems I see with this particular implementation:

1. The word list is way too small - it picks randomly 12 words out of pool with only 1626 words which makes mere ~7.42x10^29 possible combinations assuming that the random is truly random. That's fairly lower than 128 bits of entropy (~3.4x10^38) - in fact almost half a billion times lower, so even with the assumption of true randomness or using the browser's crypto facilities you're getting at best 99 bits of entropy. Either increase the word list to ~8400 words or pick 17 words instead of 12 if you're aiming at 128 bit. (Disregard this part, it applies only to unique pass generation.)

2. Relying on the user to generate sufficiently safe seed can easily break any security. Users are by definition lazy, and having them to move their mouse can end up in repetitive left-right movement over a small area (usually near the 'generate password' field) which can be exploited to lower the probability of picking some of the combinations at random. I'd add at least a delta check (if(Math.abs(lastX - e.pageX) < 20 || Math.abs(lastY - e.pageY)) return; ...) to force the users to move their mouse a bit more randomly. It wouldn't hurt to use some of the browser stats apart from the new Date to add to the seed as well.

Answer 2

The second method relies on this library: http://nxtra.org/nxt-client/js/seedrandom.js

It is a pain to read that code, but I think I can confirm that it is at least good enough for the job. The important parts are that there is a plenty big entropy pool, the code ensures that enough entropy is gathered, the whitening function scrambles the gathered entropy decently, the random generator is unbiased, and it uses a sufficiently large part of the entropy pool.

By far the biggest potential worry for that site would be lack of HTTPS, meaning that the login in any case should only be considered good enough for a low security site.