Hacker News Reader

This password manager seems to use private keys, so there is no passphrase used for encryption here.

However, generally speaking, age uses scrypt for password key derivation, with a default work factor of 2^18 (1 second on modern machines). Unlike GnuPG's S2K, scrypt is both CPU and memory hard.

View on HN

Then how short can I make my passphrase? It should be shorter than with GnuPG but no one knows how long to make the passphrase for GnuPG either...

This gets back to my original peeve. This sort of thing has to be worked out for the user. I looked through the available documentation. Was I as a user expected to look through the source code and figure it out for myself?

My understanding is that, even with a CPU and memory-hard KDF, the standard recommendation is to use a strong and difficult to guess password. It’s meant to be a layer of protection against cracking, not an opportunity to use a shorter password than you normally would.

OK, but what is that? I am a user. What do I do?

Questions like these are indistinguishable from trolling. You've responded to the direct, common-knowledge answer to your question by repeating the question. Please stop doing this.

Reply on news.ycombinator.com