14 ms·

> people that use KeePass are not memorizing 40 character passwords to unlock their password manager. I use a pass phrase that is substantially longer then 40

> people that use KeePass are not memorizing 40 character passwords to unlock their password manager. I use a pass phrase that is substantially longer then 40 characters. It doesn’t take too long to sink in.

encryptluks2 4y ago
Fair, but I think that is more of an exception than the norm. For people that may want to more frequently lock their password database, having a 40 character password would quickly become a PITA.
- throw0101a 4y ago
  > […] having a 40 character password would quickly become a PITA. Do you have a a favourite song/poem/nursery rhyme? "Hey diddle diddle, the cat and the fiddle," * https://en.wikipedia.org/wiki/Hey_Diddle_Diddle https://en.wikipedia.org/wiki/Hey_Diddle_Diddle And you only have to unlock it perhaps once at the beginning of the work day (set auto-lock/forget to 8 hours), or twice a day (morning, after lunch; auto-lock to 4 hours). Once unlocked maybe only ask for confirmation for use.
  - encryptluks2 4y ago
    To me it makes more sense to use a longer password for FDE, and maybe have it have it cached into the TPM but with a shorter unlock code for resuming, locking, etc. It might make sense to have a two tier password for password managers though. Like a hot/cold.
  - sowbug 4y ago
    Using a phrase in a book or a poem is not much stronger than using a single word as a passphrase. Attackers include such phrases in their cracking dictionaries, including variations on spelling and punctuation. After the initial hashing of the candidate passphrase, a five-letter word takes exactly as long as a 100-character lyric from a song. There are lots of sad stories of people losing funds in the early days of Bitcoin when "brain wallets" were briefly popular. Victims used quote-based passphrases that seemed unguessable. The threat model is a little different when it includes getting access to your encrypted password-manager database or OpenPGP smart card. But the point stands that a well-known phrase might as well be a dictionary word.
jamal-kumar 4y ago
I find it easier to remember a short sentence than a short password with a bunch of weird characters in it for sure

encryptluks2 4y ago

Fair, but I think that is more of an exception than the norm. For people that may want to more frequently lock their password database, having a 40 character password would quickly become a PITA.

throw0101a 4y ago
> […] having a 40 character password would quickly become a PITA. Do you have a a favourite song/poem/nursery rhyme? "Hey diddle diddle, the cat and the fiddle," * https://en.wikipedia.org/wiki/Hey_Diddle_Diddle https://en.wikipedia.org/wiki/Hey_Diddle_Diddle And you only have to unlock it perhaps once at the beginning of the work day (set auto-lock/forget to 8 hours), or twice a day (morning, after lunch; auto-lock to 4 hours). Once unlocked maybe only ask for confirmation for use.
- encryptluks2 4y ago
  To me it makes more sense to use a longer password for FDE, and maybe have it have it cached into the TPM but with a shorter unlock code for resuming, locking, etc. It might make sense to have a two tier password for password managers though. Like a hot/cold.
- sowbug 4y ago
  Using a phrase in a book or a poem is not much stronger than using a single word as a passphrase. Attackers include such phrases in their cracking dictionaries, including variations on spelling and punctuation. After the initial hashing of the candidate passphrase, a five-letter word takes exactly as long as a 100-character lyric from a song. There are lots of sad stories of people losing funds in the early days of Bitcoin when "brain wallets" were briefly popular. Victims used quote-based passphrases that seemed unguessable. The threat model is a little different when it includes getting access to your encrypted password-manager database or OpenPGP smart card. But the point stands that a well-known phrase might as well be a dictionary word.

jamal-kumar 4y ago

I find it easier to remember a short sentence than a short password with a bunch of weird characters in it for sure