5 ms·

I don't memorize any passwords except for one - the master password for KeePass. All my passwords are randomly generated, I set the minimum at 30 characters. M

by ye 13y ago

I don't memorize any passwords except for one - the master password for KeePass. All my passwords are randomly generated, I set the minimum at 30 characters. My most important passwords are 40 to 50 characters. I highly recommend a similar system. I feel a lot safer than when I had to remember passwords for my email accounts, banks, credit cards, Ebay, Paypal, my webservers, FTP, SSH. I even store my credit card info in KeePass, so I don't have to type the 16 digits every time.

DerpDerpDerp 13y ago
> I don't memorize any passwords except for one - the master password for KeePass So if a single password is compromised, all of your randomly generated passwords are compromised? So what kind of password do you use for the keyring that you believe is better than memorizing a chain of words? For reference, my longest pass phrase is a story constructed around ~30 random words, which using equivalency above, is about ~60 random characters. I don't have to rely on a password manager to keep it safe via a (probably weaker) password. Anything beyond that is simply done via carrying a physical device with a key on it.
- ye 13y ago
  @DerpDerpDerp The only way my single password can be compromised is if I get infected with a keylogger. In which case all my passwords would be compromised either way. This is still infinitely better than having insecure passwords stored in your head. Plus, how many passwords can you remember? I have around 50 entries in KeePass for all kinds of online services. There's no way I can remember that many different passwords.
deleted 13y ago
[deleted]
tga_d 13y ago
All my passwords are randomly generated, I set the minimum at 30 characters. My most important passwords are 40 to 50 characters. If you're using the printable ascii characters with fully random selection, that's 6.55 bits of entropy per character, for a total of 196.5 bits of entropy over 30 characters. For anything over 20 characters (=131 bits of entropy if randomly selected), you're implying that there is someone out there who can bruteforce the keyspace of AES (128 bits in the most common case), but can't install a keylogger on your system.
- ye 13y ago
  I usually limit them to alphanum, spaces, dashes, underscores. The rest of the characters is a pain to type on mobile. I also try to futureproof with using extra long passwords. Most of the time I copy-paste them anyway, so it doesn't matter. The attacker wouldn't know which characters I used, so they will have to have a wider coverage anyway. Keylogger is my worst fear, of course. But I try to be safe about the shit I download and how I browse the websites. I scan my PC for viruses, keyloggers and rootkits daily.
  - tga_d 13y ago
    My point is that using passwords that length doesn't gain you anything. It would take the world's fastest super computer in 20 years from now about 7 trillion years to brute force 128 bits of entropy, assuming the speed of the fastest super computer in the world keeps doubling every 1.1 years. And your passphrases have far more than that. It's like I said: The only way you can think that it provides you anything is if you also think there's some entity that makes computers orders of magnitude I can't comprehend faster than anything around, even without any sort of key extending. To brute force 20 characters, it would cost $280,000,000,000,000,000,000,000,000.00 on Amazon EC2, or about 6,000,000,000,000 times the amount of money in circulation globally. It's safe to say 20 characters is enough (as long as they're fully random); you're literally not gaining anything beyond that. My point about keyloggers was to show the disproportion of your paranoia: anyone who could attack that could also easily fund a targeted attack on your computer that you would never be able to detect, well beyond stuxnet funding levels.
    - ye 13y ago
      20 characters is definitely enough now. Who knows what computational revolutions await us.

by ye 13y ago

DerpDerpDerp 13y ago

> I don't memorize any passwords except for one - the master password for KeePass So if a single password is compromised, all of your randomly generated passwords are compromised? So what kind of password do you use for the keyring that you believe is better than memorizing a chain of words? For reference, my longest pass phrase is a story constructed around ~30 random words, which using equivalency above, is about ~60 random characters. I don't have to rely on a password manager to keep it safe via a (probably weaker) password. Anything beyond that is simply done via carrying a physical device with a key on it.

ye 13y ago
@DerpDerpDerp The only way my single password can be compromised is if I get infected with a keylogger. In which case all my passwords would be compromised either way. This is still infinitely better than having insecure passwords stored in your head. Plus, how many passwords can you remember? I have around 50 entries in KeePass for all kinds of online services. There's no way I can remember that many different passwords.

deleted 13y ago

[deleted]

tga_d 13y ago

All my passwords are randomly generated, I set the minimum at 30 characters. My most important passwords are 40 to 50 characters. If you're using the printable ascii characters with fully random selection, that's 6.55 bits of entropy per character, for a total of 196.5 bits of entropy over 30 characters. For anything over 20 characters (=131 bits of entropy if randomly selected), you're implying that there is someone out there who can bruteforce the keyspace of AES (128 bits in the most common case), but can't install a keylogger on your system.

ye 13y ago
I usually limit them to alphanum, spaces, dashes, underscores. The rest of the characters is a pain to type on mobile. I also try to futureproof with using extra long passwords. Most of the time I copy-paste them anyway, so it doesn't matter. The attacker wouldn't know which characters I used, so they will have to have a wider coverage anyway. Keylogger is my worst fear, of course. But I try to be safe about the shit I download and how I browse the websites. I scan my PC for viruses, keyloggers and rootkits daily.
- tga_d 13y ago
  My point is that using passwords that length doesn't gain you anything. It would take the world's fastest super computer in 20 years from now about 7 trillion years to brute force 128 bits of entropy, assuming the speed of the fastest super computer in the world keeps doubling every 1.1 years. And your passphrases have far more than that. It's like I said: The only way you can think that it provides you anything is if you also think there's some entity that makes computers orders of magnitude I can't comprehend faster than anything around, even without any sort of key extending. To brute force 20 characters, it would cost $280,000,000,000,000,000,000,000,000.00 on Amazon EC2, or about 6,000,000,000,000 times the amount of money in circulation globally. It's safe to say 20 characters is enough (as long as they're fully random); you're literally not gaining anything beyond that. My point about keyloggers was to show the disproportion of your paranoia: anyone who could attack that could also easily fund a targeted attack on your computer that you would never be able to detect, well beyond stuxnet funding levels.
  - ye 13y ago
    20 characters is definitely enough now. Who knows what computational revolutions await us.