DisPass is a passphrase generator for GNU/Linux, *BSD, MacOS X and Windows. It enables you to generate unique passphrases formed from a master password and a label, helping you get rid of the bad habit of using a single password for multiple websites. When using a different passphrase for every website, the chance of abuse of your password on other sites (when a website leaks it) is eliminated. Dispass is a console application, but also has a simple graphical interface.
DisPass has several homes on the Internet:
- Main website
- http://dispass.babab.nl
- The cheeseshop (PyPI) project page
- http://pypi.python.org/pypi/DisPass/
- Github repository and Issue tracker
- https://github.com/babab/DisPass/
- Bitbucket repository
- https://bitbucket.org/babab/dispass/
Here are some definitions which may help you understand the rest of the documentation better.
- label
- A label is a string that you use to identify the passphrase. This can be a domainname of the service the passphrase is used for, e.g. 'google.com'.
Since this program asks for a password/passphrase to generate another password/passphrase, things may get a bit confusing. I've dediced to use the words 'password' and 'passphrase' diffently and consistent.
- password
- Use of the word 'password' is dedicated to the input password, i.e. the password you are asked to enter and only you know. Whenever you read password, this is the one I mean. The password needs to be at least 8 characters long and does not have a maximum length.
- passphrase
- With 'passphrase' I always mean the output passphrase, i.e. the passphrase that is unique and generated from a label, password and sequence number. Generated passphrases are 30 characters long. The length can be optionally changed.
A recent version of Python 2 is required for running dispass.
The recommended way is to download and install directly from the PyPI repository using pip:
$ sudo pip install dispass
You must have python's docutils installed in able to do so. This will install the dispass module in python's dist-packages folder. You can now run dispass using the 'dispass' and 'gdispass' scripts placed under '/usr/local/bin/' or '/usr/bin/'.
The PyPI project page is at http://pypi.python.org/pypi/DisPass/
Clone git repo:
$ git clone git://github.com/babab/DisPass.git $ cd dispass
Then you can either:
Install through pip:
$ python setup.py sdist $ sudo pip install dist/DisPass-<version>.tar.gz
Install manually:
$ sudo python setup.py install
You can easily upgrade to newer versions using pip:
$ sudo pip install dispass --upgrade
If you have installed dispass using pip, you can easily uninstall at any moment:
$ sudo pip uninstall dispass
When DisPass is executed as 'gdispass' or 'dispass -g', the graphical version will be started.
You can use dispass by entering your labels after the dispass command and/or you can store your labels in a textfile called a labelfile.
| USAGE: | dispass [options] dispass [options] <label> [<label2>] [label3] [...] gdispass |
|---|
Options (general):
| -c, --create | use if this passphrase is new (check input PW) |
| -g, --gui | start guided graphical version of DisPass |
| -h, --help | show this help and exit |
| -o, --output | output passphrases to stdout (instead of the more secure way of displaying via curses) |
| -V, --version | show full version information and exit |
| --script | optimize input/output for 'wrapping' dispass |
Options (when using labelfile):
| -s <string>, --search=<string> | |
| dispass label from file that uniquely matches <string> | |
| -f <labelfile>, --file=<labelfile> | |
| set location of labelfile | |
Options (when passing labels as arguments):
| -l <length>, --length=<length> | |
| set length of passphrase (default: 30, max: 171) | |
| -a <algorithm>, --algo=<algorithm> | |
| override algorithm for generating passphrase(s) | |
| -n <number>, --number=<number> | |
| override sequence number (default = 1) | |
You can start using dispass for e.g. google.com like this:
$ dispass -c google.com
Now you will be asked to enter a password twice and after that your passphrase will be shown on the screen. This will now be the passphrase you will use for logging in to google.com It can be created everytime you need it by running:
$ dispass google.com
The -c argument we used before was just a way to make sure to not make
typos when creating passphrases for the first time. It is advised you use
this everytime you create a passphrase for a new label.
The passphrases created are 30 characters long by default, but some website's
may not validate such a long passphrase or you might want to make it even
longer. You can easily set a desired passphrase length using the -l flag.
If you wanted to make your google.com 18 chars you can run:
$ dispass -c -l 18 google.com
Generating passphrases for multiple labels is just as easy:
$ dispass google.com yahoo.com
When dispass is run without arguments it will try to find a labelfile. The location of this file varies and depends on the platform type you use, the file flag and the environment variables that may be set:
You can override the location of the labelfile using the -f flag.
This can be a way for you to use different sets of labels/passphrases
with a different 'master' password for each set.
- If -f flag is given, that value is used.
- If environment var DISPASS_LABELFILE is set, that value is used.
- If environment var XDG_CONFIG_HOME is set,
$XDG_CONFIG_HOME/dispass/labelsis used. - If none of the above applies, the labelfile will default to the following
locations:
- GNU/Linux and Mac OS X:
~/.config/dispass/labels - *BSD and other Unixen:
~/.config/dispass/labels - Windows:
C:\Users\<username>\dispass\labels
- GNU/Linux and Mac OS X:
You can start by copying the labelfile from skel/dot.dispass to this location and editing it by adding your own labels. Or you can just start writing the file from scratch which really isn't a hard thing to do.
The labels need to be specified on a single line with optional arguments. A typical labelfile might look like this:
google.com length=18 yahoo.com
Now, when running dispass without arguments it will create two
passphrases with varying lengths.
| USAGE: | dispass-label [-hlV] [-f <labelfile>] [--script] |
|---|
Options:
| -h, --help | show help and exit |
| -l, --list | print all labels and options found in labelfile |
| -V, --version | show full version information and exit |
| -f <labelfile>, --file=<labelfile> | |
| set location of labelfile | |
| --script | optimize input/output for 'wrapping' dispass-label |
You can start using gDisPass by running the gdispass executable.
Fill in a name for the label that you can easily remember.
To generate a passphrase for a new label, i.e. a label that you have never used before, check the appropiate checkbox. This will allow you to enter the (master) password twice. gDisPass will then compare the passwords to see if they are the same. This is needed to minimize the risk of typos. It is advised that you check the box everytime you create a passphrase for a new label.
Subsequential generation of passphrases for the same label most probably do not need this check. You will likely be warned when/if you made a typo by the system or website you want to authenticate for.
If you correctly entered a label and password, you can generate the passphrase by pressing <Return> or by clicking the appropiate button. The resulting passphrase will be focused and selected. On platforms that support it (e.g. *BSD or GNU/Linux) the passphrase will be automatically placed into your copy/paste buffer.
Resetting all fields when you are done or when you need to quickly cancel the generation (because someone is watching over your shoulders) can be done by pressing <Escape> or by clicking the appropiate button.
If you have Emacs you can use the Emacs wrapper created and maintained by Tom Willemsen (ryuslash).
You can find it at: https://github.com/ryuslash/dispass.el
You can use dispass entirely as you wish and create different interfaces by using the appropiate libraries as long as it is allowed by the ISC license.
Dispass provides a way to make the behaviour and IO more suitable for
scripting by passing the --script option.
If the --script flag is passed together with -o or --output
the output will be optimized for easy parsing by other programs
and scripts by always printing one entry on a single line using
the following positions:
Column 1-50 : label
If the --script flag is passed together with -l or --list
the output will be optimized for easy parsing by other programs
and scripts by not printing the header and always printing one
entry on a single line using the following positions:
Column 1-50: label (50 chars wide) Column 52-54: length (3 chars wide) Column 56-70: hash algo (15 chars wide) Column 72-74: sequence number (3 chars wide)
Otherwise an ascii table is printed with a variable width depending on the length of the longest label. The table has a header but does not display the hash algo until support for multiple hashing algos is added.
Please use the Issue tracker at github: https://github.com/babab/DisPass/issues
You can also visit #dispass at Freenode (chat.freenode.net) with your favorite IRC client.
Many thanks go out to Tom (@ryuslash) Willemsen for valuable contributions to gdispass and the new algorithm. He also wrote an awesome wrapper for Emacs so you can use DisPass in your favorite editor.
Copyright (c) 2011-2012 Benjamin Althues <benjamin@babab.nl>
Permission to use, copy, modify, and distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.