Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

If you're not using a password manager now, that implies you're already remembering at least one password. Using it on a regular basis is a good way to keep it in your head.

You can setup your password manager authorization to expire periodically (eg, every 30 days) as well as on reboot. With LastPass (probably others) you can also mark certain sites as 'high security' and require entering your master password again. I do this with a small handful of sites, including my bank and domain registrar. I typically log into my bank once or twice a month.

I very rarely reboot my devices (sleep + locked with a different password I have memorized and type in) so I don't get prompted for it that much otherwise, but enough that I have it memorized.

I haven't had the time to read the full article, however I think I might have an answer to your question. The entropy computes the strength of the algorithm used to generate passwords, not the strength of the password itself. So basically, you are getting the strength of the password if the attacker knows the algorithm.

I couldn't find a better source than this stackexchange thread : https://security.stackexchange.com/questions/167235/how-does...

Hope it helps

Most password managers have an emergency kit, where you can print your master password and other info, and put it somewhere like a safe, bank vault, etc

Not a safety deposit box at the bank?

Novice in the area, so grain of salt (and if you can correct me where I'm wrong, that'd be great. All for learning):

1) I don't think the base changes nor the exponent deviates from the character approach (in reference to the 20,000, 40,000, and 171,000 base stated). If we're in a system that allows all uppercase letters, all lower case letters, all special characters, and all numbers, then the base is the sum of those: regardless if my password is purplepenguinparade because you don't know that I've artificially set parameters for my password within the existing parameters. It could be argued you could try all permutations of lowercase characters first (base 26) but then how do you know to go to 26^19 before adding more to the base?

1a) if the hashed passwords give away tells as to what the decoded password is like (in this case 3 words lowercase), that'd seem like a concern about the encryption moreso than the password.

2) The 20,000 and 40,000 part seems like a meaningless piece of trivia. What if one of the words I want to use doesn't fall in your 20,000-40,000 word store? You're never going to crack my password. Better go the full 171,000 or whatever it was and hope I don't slip an extra character of the numeric, special character, upper/lower case variety.

-------------

While I do personally use a password manager, it isn't perfect for me either (requires loading 1Password 2x on Windows 10 for me because the first attempt does nothing, but loads on second try). I do hope more OS creators do like Apple did to better tie in with password managers and that may help alleviate some of it). So I don't see my parents or grandparents, for example, using one.

That said, for the rank and file folks that are taking their security advice from the government and police departments, I think pushing for various words in sequence is much better advice than "8 characters in length because it takes longer to guess than 6 characters" or whatever it is that people predominantly operate under and usually ties back to something about themselves that someone with some familiarity about them could guess (if I recall, this is what happened to Sarah Palin when she was hacked shortly after being McCain's VP nominee).