Securely Yours, Love Password Managers (2021)

Your mentor is right in that length is the more important factor. The character set has a multiplying effect whereas the length has an exponential effect, so 11 lowercase letters is 26^11 combinations, a bit over half as many as 8 special chars (95^8).

It's worth noting that neither of those would be considered a "safe" password - 15 characters for only lowercase and 13 for a mix of all characters is the recommended minimum.

It makes less difference when you consider that the attacker doesn't know you're using a passphrase so will probably be checking for those extra characters anyway.

What does make a difference is that the passphrase is designed to be remembered but should be unique per login. So with 30+ logins you're remembering 30+ passphrases or might you be tempted to reuse some?

You can get the advantages of a passphrase with a password manager but the same is not true in reverse.

In challenge response, your password manager has a cosmetic software control that prompts you to authenticate yourself with your Yubikey before it will expose the decryption key which in turn exposes your entire password database. This does not help you in the event your system is compromised, as an attacker would just have a background job that waits until the next time you authenticate and steal all secrets just after.

When you use a true hardware encryption solution like Password Store with a Yubikey, it actually encrypts every single secret as individual blobs to a asymmetric public key in the Yubikey. The encryption key never once comes in contact with system memory. Instead a single requested secret is sent to the Yubikey, the decryption is done there in isolated memory and CPU, and then that single plaintext secret is sent back to the OS, provided the user touched the device.

To summarize, let's assume your system is compromised with a rootkit by a remote actor. You have 100 secrets stored in both Keepass with Yubikey authentiction, and in Password Store with Yubikey encryption.

To steal all your secrets from Keypass they only need to wait for you to tap your Yubikey once to get all 100 secrets, if that. They could just skip that check after all as it is just cosmetic. They have root and can modify any binary they want.

Meanwhile in the Password Store setup to get all your 100 secrets your adversary has to trick you into tapping your Yubikey 100 times. Presumably you would notice something was up and have some damage control.

Yes, exactly. But how many logins does the average user have? Dozens at least. What's a secure password? 12+ elements (alphanumeric and specials). That is impossible to keep in your head. The only way the average person can make use of complex, secure passwords is by having a single one and reusing that. This is where password managers come into play. You simply create unique passwords, with strong security to each. Again, these will be impossible to remember. So the entire point of passphrases is moot: you are not supposed to remember them, let alone know them. Yes, not even know them. It's the password manager's job!

The only exception (I know of) is passwords that need to be entered regularly, offline, like the operating system's login screen. Those better be passphrases: they can be remembered, but can also be made secure enough by modern standards. The master password to my password manager is such a passphrase, with some modifications. So is the login to my AD user (here, and only here, I used the passphrase generator). That's it. The rest are very long, randomly generated passwords (not phrases), of which I know none.

This is, to my knowledge, the "idiomatic" and "correct" way of using password managers today.