Often this doesn't meet the requirements for a password e.g. uppercase requirement. In that case I might use such a generator to get me started with some random words (more random than I'd come up with myself) and then mould it to fit the requirements before saving.
Ask HN: Are Generated Passphrases Safe?
11–15 of 15 posts
Re: Ask HN: Are Generated Passphrases Safe?
#12I suggest using the non-white space seperator like a -: spiny-approval-avalanche uncouth-tattoo If Bitwarden default is not safe, the software should not be used.
By default, it uses a dash "-" as separator. I was mucking around with different settings when I discovered it. It also uses 4 words by default and I changed it to 5. Funnily enough, I read a few articles that specifically suggested 4 words is fine but 5 is ideal.
Depends on the application. For an online login account, 4 might be enough (not used for anything other than login, eg, not using the same password for encrypting your data in the backend). The are rate limits and brute force blockers (though sometimes those feature can be bypassed).
For file or disk encryption? Absolutely not. Use 10 words minimum (it depends on the word list, but 10 is a safe bet across the board).
Re: Ask HN: Are Generated Passphrases Safe?
#13Yes. The purpose of this sort of password convention is to make it more human friendly (easier to remember or dictate), while maintaining security. Password strength / entropy is all about how long would it take an attacker to brute force. Practically, we think about this in terms of S(p) = number of possible tries / tries per second. This yields how long it would take an adversary to crack your password, in the wors…
Maybe you could do OP a favor and redo the calculation, assuming that an attacker knows that he used passphrases. Assuming that an english dictionary has maybe 10.000 meaningful words... And then even worse if you assume that the attacker even knows that he was using Bitwarden for that and an attacker can easily lookup the dictionary that Bitwarden is using. So with maybe 1000 words and 5 words used ...
Re: Ask HN: Are Generated Passphrases Safe?
#14Yes. The purpose of this sort of password convention is to make it more human friendly (easier to remember or dictate), while maintaining security. Password strength / entropy is all about how long would it take an attacker to brute force. Practically, we think about this in terms of S(p) = number of possible tries / tries per second. This yields how long it would take an adversary to crack your password, in the wors…
Maybe you could do OP a favor and redo the calculation, assuming that an attacker knows that he used passphrases. Assuming that an english dictionary has maybe 10.000 meaningful words... And then even worse if you assume that the attacker even knows that he was using Bitwarden for that and an attacker can easily lookup the dictionary that Bitwarden is using. So with maybe 1000 words and 5 words used ...
[deleted]
Re: Ask HN: Are Generated Passphrases Safe?
#15I suggest using the non-white space seperator like a -: spiny-approval-avalanche uncouth-tattoo If Bitwarden default is not safe, the software should not be used.
> If Bitwarden default is not safe, the software should not be used.
The definition of "safe" depends on your risk model; what is appropriate for people named Snowden is not necessarily appropriate for many others.