From 85c906727a24ab97a3c2908c72ad37ad988ecb01 Mon Sep 17 00:00:00 2001
From: Ian Coleman <ian@iancoleman.io>
Date: Thu, 12 Apr 2018 11:46:44 +1000
Subject: [PATCH] Warn when generating low entropy mnemonics

---
 src/index.html      |  7 ++++++-
 src/js/index.js     | 12 ++++++++++++
 tests/spec/tests.js | 27 +++++++++++++++++++++++++++
 3 files changed, 45 insertions(+), 1 deletion(-)

diff --git a/src/index.html b/src/index.html
index 2ee79c0..df5bf67 100644
--- a/src/index.html
+++ b/src/index.html
@@ -48,7 +48,12 @@
                                             <option value="21">21</option>
                                             <option value="24">24</option>
                                         </select>
-                                        <span>words</span>
+                                        <span>words</span>.
+                                        <p class="warning help-block hidden">
+                                            <span class="text-danger">
+                                                Mnemonics with less than 12 words have low entropy and may be guessed by an attacker.
+                                            </span>
+                                        </p>
                                     </div>
                                 </div>
                             </div>
diff --git a/src/js/index.js b/src/js/index.js
index ee47509..0a2d362 100644
--- a/src/js/index.js
+++ b/src/js/index.js
@@ -88,6 +88,7 @@
     DOM.bip141path = $("#bip141-path");
     DOM.bip141semantics = $(".bip141-semantics");
     DOM.generatedStrength = $(".generate-container .strength");
+    DOM.generatedStrengthWarning = $(".generate-container .warning");
     DOM.hardenedAddresses = $(".hardened-addresses");
     DOM.useBitpayAddressesContainer = $(".use-bitpay-addresses-container");
     DOM.useBitpayAddresses = $(".use-bitpay-addresses");
@@ -114,6 +115,7 @@
 
     function init() {
         // Events
+        DOM.generatedStrength.on("change", generatedStrengthChanged);
         DOM.network.on("change", networkChanged);
         DOM.bip32Client.on("change", bip32ClientChanged);
         DOM.useEntropy.on("change", setEntropyVisibility);
@@ -155,6 +157,16 @@
 
     // Event handlers
 
+    function generatedStrengthChanged() {
+        var strength = parseInt(DOM.generatedStrength.val());
+        if (strength < 12) {
+            DOM.generatedStrengthWarning.removeClass("hidden");
+        }
+        else {
+            DOM.generatedStrengthWarning.addClass("hidden");
+        }
+    }
+
     function networkChanged(e) {
         clearDerivedKeys();
         clearAddressesList();
diff --git a/tests/spec/tests.js b/tests/spec/tests.js
index 571047f..945a923 100644
--- a/tests/spec/tests.js
+++ b/tests/spec/tests.js
@@ -3503,4 +3503,31 @@ it('Uses vprv for bitcoin testnet p2wpkh', function(done) {
     });
 });
 
+it('Shows a warning if generating weak mnemonics', function(done) {
+    driver.executeScript(function() {
+        $(".strength option[selected]").removeAttr("selected");
+        $(".strength option[value=6]").prop("selected", true);
+        $(".strength").trigger("change");
+    });
+    driver.findElement(By.css(".generate-container .warning"))
+        .getAttribute("class")
+        .then(function(classes) {
+            expect(classes).not.toContain("hidden");
+            done();
+        });
+});
+
+it('Does not show a warning if generating strong mnemonics', function(done) {
+    driver.executeScript(function() {
+        $(".strength option[selected]").removeAttr("selected");
+        $(".strength option[value=12]").prop("selected", true);
+    });
+    driver.findElement(By.css(".generate-container .warning"))
+        .getAttribute("class")
+        .then(function(classes) {
+            expect(classes).toContain("hidden");
+            done();
+        });
+});
+
 });
-- 
2.41.0