3 ms·

Does that matter? Some passwords are a long-term security solution so who knows what kind of flaws, advances, or use cases you may have to deal with. The limits

Does that matter? Some passwords are a long-term security solution so who knows what kind of flaws, advances, or use cases you may have to deal with. The limits should be whatever the software and hardware permits. Besides, a local password generator can be a convenient way to generate random strings for other uses as well.

nabla9 6y ago
You gain nothing. The password is compressed into 256-bit key at the end so you gain nothing. Argon2 is used to derive the key, so all you need to worry is good password and maybe use keyfile if you want more security.
- class4behavior 6y ago
  You're talking about the password for the password manager file, I think. I'm talking about the actual passwords you save. A password manager shouldn't be limiting or directing the user on the length of a passwords they need. If someone, for instance, wants a hex char string with more than 512 entropy, they need more than 128 chars.
  - nabla9 6y ago
    KeePassXC 2.6.2 does not have 128-bit limit for passwords you save. I don't know if the previous versions had because I have not tested.
tialaramex 6y ago
> Does that matter? Yes. Right now what you're asking for is useless nonsense, and your provided motivation is basically "But I want it" which puts you slightly lower priority than the little girl who wants a pony 'cos at least she can articulate why.
kokx 6y ago
It matters. It may trick people into thinking that longer = more secure. Which is only the case up to a certain extent. If you reach beyond 256 bits of entropy, there is no added security. No current system will use more than that. And going beyond that is not future proofing, because you're storing it in a current system, defeating any added entropy. I don't see good reasons why you would use a password generator embedded in a password manager for non-security purposes. Security purposes here are always more important than other uses. But if you do have a good example, feel free to prove me wrong.

nabla9 6y ago

You gain nothing. The password is compressed into 256-bit key at the end so you gain nothing. Argon2 is used to derive the key, so all you need to worry is good password and maybe use keyfile if you want more security.

class4behavior 6y ago
You're talking about the password for the password manager file, I think. I'm talking about the actual passwords you save. A password manager shouldn't be limiting or directing the user on the length of a passwords they need. If someone, for instance, wants a hex char string with more than 512 entropy, they need more than 128 chars.
- nabla9 6y ago
  KeePassXC 2.6.2 does not have 128-bit limit for passwords you save. I don't know if the previous versions had because I have not tested.

tialaramex 6y ago

> Does that matter? Yes. Right now what you're asking for is useless nonsense, and your provided motivation is basically "But I want it" which puts you slightly lower priority than the little girl who wants a pony 'cos at least she can articulate why.

kokx 6y ago

It matters. It may trick people into thinking that longer = more secure. Which is only the case up to a certain extent. If you reach beyond 256 bits of entropy, there is no added security. No current system will use more than that. And going beyond that is not future proofing, because you're storing it in a current system, defeating any added entropy. I don't see good reasons why you would use a password generator embedded in a password manager for non-security purposes. Security purposes here are always more important than other uses. But if you do have a good example, feel free to prove me wrong.