> people that use KeePass are not memorizing 40 character passwords to unlock their password manager.
I use a pass phrase that is substantially longer then 40 characters. It doesn’t take too long to sink in.
I use a pass phrase that is substantially longer then 40 characters. It doesn’t take too long to sink in.
Do you have a a favourite song/poem/nursery rhyme?
"Hey diddle diddle, the cat and the fiddle,"
* https://en.wikipedia.org/wiki/Hey_Diddle_Diddle
And you only have to unlock it perhaps once at the beginning of the work day (set auto-lock/forget to 8 hours), or twice a day (morning, after lunch; auto-lock to 4 hours). Once unlocked maybe only ask for confirmation for use.
There are lots of sad stories of people losing funds in the early days of Bitcoin when "brain wallets" were briefly popular. Victims used quote-based passphrases that seemed unguessable.
The threat model is a little different when it includes getting access to your encrypted password-manager database or OpenPGP smart card. But the point stands that a well-known phrase might as well be a dictionary word.