Repository: freedomofpress/securedrop

Issue:
Remove source choice in number of words in codename
I think it would look a bit nicer and streamline the user experience if we got rid of the option to choose the number of Diceware words in the generate view for sources. I don't see a reason to make the codename longer than 7 words considering the strong scrypt parameters we've chosen. I assume it can be a confusing option for sources who don't understand how Diceware serves as an entropy encoding mechanism or how their codename fits into the security model of SD (i.e., most all sources).


Discussion:

Resolving patch:
diff --git a/securedrop/source.py b/securedrop/source.py
--- a/securedrop/source.py
+++ b/securedrop/source.py
@@ -126,7 +126,7 @@ def index():
                            custom_notification=config.CUSTOM_NOTIFICATION)
 
 
-def generate_unique_codename(num_words):
+def generate_unique_codename(num_words=7):
     """Generate random codenames until we get an unused one"""
     while True:
         codename = crypto_util.genrandomid(num_words)
@@ -158,18 +158,9 @@ def generate():
               "to create a new account, you should log out first.", "notification")
         return redirect(url_for('lookup'))
 
-    num_words = 7
-    if request.method == 'POST':
-        num_words = int(request.form['number-words'])
-        if num_words not in range(7, 11):
-            abort(403)
-
-    codename = generate_unique_codename(num_words)
+    codename = generate_unique_codename()
     session['codename'] = codename
-    return render_template(
-        'generate.html',
-        codename=codename,
-        num_words=num_words)
+    return render_template('generate.html', codename=codename)
 
 
 @app.route('/create', methods=['POST'])


Test patch:
diff --git a/securedrop/tests/test_unit_source.py b/securedrop/tests/test_unit_source.py
--- a/securedrop/tests/test_unit_source.py
+++ b/securedrop/tests/test_unit_source.py
@@ -15,7 +15,7 @@
 import utils
 
 
-class TestSourceApppp(TestCase):
+class TestSourceApp(TestCase):
 
     def create_app(self):
         return source.app
@@ -58,24 +58,6 @@ def test_generate(self):
         # codename displayed to the source
         self.assertEqual(codename, escape(session_codename))
 
-    def test_regenerate_valid_lengths(self):
-        """Make sure we can regenerate all valid length codenames"""
-        for codename_len in xrange(7, 11):
-            response = self.client.post('/generate', data={
-                'number-words': str(codename_len),
-            })
-            self.assertEqual(response.status_code, 200)
-            codename = self._find_codename(response.data)
-            self.assertEquals(len(codename.split()), codename_len)
-
-    def test_regenerate_invalid_lengths(self):
-        """If the codename length is invalid, it should return 403 Forbidden"""
-        for codename_len in (2, 999):
-            response = self.client.post('/generate', data={
-                'number-words': str(codename_len),
-            })
-            self.assertEqual(response.status_code, 403)
-
     def test_generate_has_login_link(self):
         """The generate page should have a link to remind people to login
            if they already have a codename, rather than create a new one.