Entropy isn't sufficient to measure password strength • Hacker News Board

Re: Entropy isn't sufficient to measure password strength

#121

Post by shepherdjerred » Wed, Jan 19, 2022, 12:50 AM UTC

witrak wrote: post #52

shepherdjerred wrote: post #47

Earlier quoted context omitted.

It’s completely valid to distrust password managers. No software is free from bugs, or accidentally exposing your passwords. It might take a lot of work, but it’s certainly possible. There’s also the possibility of mismanaging your password database and losing all of your data.

> It’s completely valid to distrust password managers. Is it, really? And at the same time to trust one's memory? For memorizing hundreds of long passwords? Don't think so...

Distrusting password managers does not implicitly trust your own memory.

There are alternatives to programmatic password managers or human memory, e.g. a paper notebook and a safe. That's not an approach I would personally take, but I imagine it's a reasonable option for someone who sees the potential danger of trusting any program for sensitive data.

Re: Entropy isn't sufficient to measure password strength

#122

Post by shepherdjerred » Wed, Jan 19, 2022, 12:50 AM UTC

invisiblerobot wrote: post #81

shepherdjerred wrote: post #45

Earlier quoted context omitted.

Yes, but it’s not too hard to make one ridiculously long/complicated master password that is also memorable. It might take you a while to remember it — just keep it written down on paper somewhere private & safe and refer to it as needed. If you’re not being targeted then you’ll probably be fine.

It doesn't need to be complicated. Just long. ie theuniverseis99%emptyspaceatleastthatswhatiwastaughtbymr.cattoningrade6 easy to remember without paper and uncrackable. Pair it with a yubikey and that's your bitwarden master

aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa is an equally long password, but much less safe than your example password because my password has far less entropy.

Re: Entropy isn't sufficient to measure password strength

#123

Post by c0balt » Wed, Jan 19, 2022, 6:02 AM UTC

rvense wrote: post #36

c0balt wrote: post #30

Earlier quoted context omitted.

Most likely to make dictionary attacks against the password(s) ineffective.

Also makes them more resistant to people looking over your shoulder.

I recommend changing the keyboard layout silently when someone is looking over your shoulder.

Re: Entropy isn't sufficient to measure password strength

#124

Post by GoblinSlayer » Wed, Jan 19, 2022, 12:33 PM UTC

krupan wrote: post #111

GoblinSlayer wrote: post #53

Earlier quoted context omitted.

A shared secret is not an attack vector though, a reused secret is. If you reuse an asymmetric key, it will identify you across the world. But if you don't reuse an asymmetric key, then the point of asymmetric cryptography is moot and is no better than a password manager.

Identifying yourself is the whole point of logging in to a website. Yes, if you want to maintain a distinct digital identity for each website you’ll need to use a different key pair for each website, which by the way is actually feasible. With our current email-address-and-password scheme that is so difficult to do it might as well be impossible. You’d need a distinct email account for each distinct digital identity…

If a web site wants your email address or phone number, it will require them, asymmetric cryptography won't help you. On the other hand, this very site uses password authentication, but doesn't require an email address.