Hacker News Reader

Comment by zeveb | Hacker News Reader

> I use a password manager and generate 30-ish character long passwords

Do note that you don't need anything more than 22 random mixed-case letters & digits: 26 lower-case letters plus 26 upper-case letters plus ten digits is 62, and 62²² ≈ 2¹²⁸.

Completely agree re. the ineptitude of the developers of sites that try to limit one to less than that.

View on HN

diceware.com

Diceware encourages reuse of a single password on multiple sites. It's also much more time consuming than just clicking the "randomly generate password" button and having it spit out a 30 char password. That, and a randomly generated password of, say, 16 chars is much much more secure than a diceware generated password of 4 or 5 words, IIRC. And I'd still need a password manager, because reusing passwords on different sites / accounts is a big no-no.

Diceware is good for encryption passkeys or for master passwords for password managers.

It is awful for actual third-party passwords.

I also find Diceware-style wordlists useful for those "security questions" that are really "backup passwords for use over the phone". Instead of "real" answers to "What's the maiden name of my third grade elementary school teacher?" I try to roll a passphrase, store it in key/value section of the password manager. The Diceware might give "weird" words, but they are all at least pronounceable/describable to a human on the other end of a phone, which still matters in some cases.

This says that "alger klm curry blond puck" is easy to remember. I would forget that very quickly.

Yeah, the default word list is pretty terrible. Try one of the ones from the EFF: https://www.eff.org/deeplinks/2016/07/new-wordlists-random-p...

ugh, the actual wordlist is a single hyperlinked sentence in the center of a thousand word essay.

Here's a direct link: https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt

There are multiple word lists mentioned in that article, accompanied by an explanation of what types of words they include. Depending on your personal preferences, you might want to use a different list. That's why I linked the blog post and not the word lists directly.

Try to make a (short) story/idea connecting those random words. Stories, something with sense and meaning, are easier to remember. correct horse battery staple is the usual example about this.

It's funny, I just came back to HN and saw your comment. I have absolutely no idea what that password was and I'm sure I would have forgotten the short story. Maybe that story would work for one main password on a password manager, but I don't think it would work for me at least for more than one or two passwords.

You need a mental picture/narrative to remember passphrases.

There are alternative lists you can look at.

Reply on news.ycombinator.com