• 0 Posts
  • 151 Comments
Joined 1 year ago
cake
Cake day: June 11th, 2023

help-circle













  • I can have 20,000 character long passwords with a password manager

    Sure. Most websites will either truncate them or outright reject them due to being too long, but sure.

    Most users, however, will use the 12 to 16 characters auto-generated ones, though, which are sufficiently hard to crack (though not as much as an easy to remember passphrase, not that it matters; the easy to remember part is what matters about passphrases).

    that makes it significantly less secure

    No it doesn’t. Even if a few of the passphrases leak, your algorithm, if well chosen, shouldn’t be easy to reverse engineer… and unless someone is specifically targeting you (and has access to enough of your passphrases) there’s much easier fish to catch; if a leaked passphrase doesn’t work in other sites, no one will waste time trying to figure out if it has some logic to it.

    I could have 20,000 character completely unique passwords with a password manager

    No you couldn’t. You’d have one password and one password manager (which would have all “your” other passwords; as would anyone else with access to your password manager).

    Until you lose access to your password manager, of course… which is bound to eventually happen, due to hardware or software issues or loss of the device if it’s local, or due to network issues, the provider discontinuing the service, or inevitable enshittification if it’s online.

    And, of course, you’ll have a single point of attack from which your password can be leaked (or sold, if it’s an online service) or stolen.


  • vastly more complex passwords

    Complexity is practically irrelevant when compared to length when it comes to passwords. That’s the point of passphrases.

    do you actually expect people to remember 100+ unique phrases

    You can have a small number of passphrases and simply choose one and add a word or two based on the site. It’s trivial to “remember” an infinite number of unique passphrases if you’ve got an algorithm. 🤷‍♂️


  • This assumes a) passwords, and b) poor passwords at that.

    Passphrases are easy to remember, extremely hard to crack, and easily customisable for every site, and you don’t need no fucking password manager to store them.

    Though I’ll give you this: password managers are not, after all, necessarily single points of failure.

    If you need a password manager to manage your passwords you’re a much more vulnerable point of failure than your password management bloatware itself.

    correct horse battery staple