Clarify dice-only hash secrecy warning
What the developer wrote
Authored by scgbckbone
Clarify dice-only hash secrecy warning
What changed, and why it matters
This commit only rewords an on-screen user warning about keeping dice-roll hashes secret. It does not change any code behavior, cryptography, or security logic. The change makes the warning more precise: it clarifies that seeing any intermediate hash (not just the final one) could let someone recreate the wallet from the dice rolls entered up to that point. There is no vulnerability or security fix here.
No action required. This is a non-security text clarification.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch updates the DICE_ONLY_WARNING string in shared/seed.py and adjusts two test assertions to match the new wording. No functional code paths, randomness mixing, seed derivation, or display logic are modified. The change is purely documentation/UI text.
Changed components
shared/seed.py (warning text only)testing/test_ephemeral.py (test assertion text only)testing/test_ux.py (test assertion text only)Inspect captured patch +3 / −3
### shared/seed.py
@@ -84,7 +84,7 @@
DICE_ONLY_WARNING = '''\
These dice rolls will be the only source of randomness for your seed. No hardware-generated randomness is mixed in.
-The hash shown while rolling is SECRET. Anyone who sees or photographs the final hash can recreate your wallet and steal the funds.
+The hash shown while rolling is SECRET. Anyone who sees or photographs one can recreate the wallet derived from the rolls entered so far and steal its funds.
Keep the screen hidden from people and cameras. If you verify the hash elsewhere, use only a trusted offline device and erase all traces afterward.'''
### testing/test_ephemeral.py
@@ -538,7 +538,7 @@ def test_ephemeral_dice_security_checks(reset_seed_words, goto_eph_seed_menu,
title, warning = cap_story()
assert title == 'WARNING'
assert 'only source of randomness' in warning
- assert 'final hash can recreate your wallet' in warning
+ assert 'wallet derived from the rolls entered so far' in warning
press_select()
for ch in '123456':
### testing/test_ux.py
@@ -232,7 +232,7 @@ def test_import_from_dice(count, nwords, goto_home, pick_menu_item, cap_story, n
title, warning = cap_story()
assert title == 'WARNING'
assert 'only source of randomness' in warning
- assert 'final hash can recreate your wallet' in warning
+ assert 'wallet derived from the rolls entered so far' in warning
press_select()
time.sleep(0.1)
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.