Suppose I have a master password to my password manager. It's more or less secure. Now I want to enhance it - e. g. add 5 more characters somewhere, replace some characters, but let's say 20 chars of original password remain the same. How secure is such approach comparing to inventing (and remembering) the brand-new password?
3 Answers
To a first approximation, your problem is one of entropy computation. Estimate the entropy of your first password then the entropy of your second one and compare the two. You should aim to have at least 128 bits of entropy. Zxcvbn is a good estimator. You can also do it by hand.
Compared to inventing a new one, do what's more convenient for you. However, if you reused this password in part or in totality elsewhere, you should definitively invent a new one for your password manager.
answered Nov 16, 2016 at 13:20
-
1
-
17@Joshua points out a human element....my team once used an iPad on a prolonged loan with a password we found very hard to memorize. We weren't allowed to change the password. A sticky note with the password soon appeared taped to the back of the iPad. Nov 16, 2016 at 21:41
-
@Joshua Personally I use the first letters of words from a passphrase. You can easily get 128 bits of entropy with a password relatively easy to remember and hard to guess. You just have to make sure the passphrase doesn't exist in books or songs to avoid dictionary attacks. Nov 17, 2016 at 7:59
-
1Obligatory upvote for any answer which links to XKCD Nov 17, 2016 at 8:50
-
1A password does not have to be a single word. Easy to remember, almost impossible to bruteforce:
hello horse command information security home. A website that doesn't allow blankspaces should be considered weak anyways, should not use those services. Nov 17, 2016 at 14:10
It depends on what you intend by secure.
If the previous password had never been compromised, even partially by someone looking over you shoulder to read some characters from it, its quality is still intrinsic, meaning that it only depends on the total length and the characters used in it - it is the entropy, as A. Hersean said.
On the other hand, if it has been compromised, the attacker that knows it could first try variations on it. And in that case the quality (entropy) is only given by the new or replaced characters, which is much less than in the first use case.
TL/DR: if you can be sure that nobody else had any knowledge of the old password, improving it is perfectly correct. But IMHO as you cannot be sure of that (if you were why would you need to change it?), it is better to use a brand-new one.
answered Nov 16, 2016 at 15:45
-
4to further add to this. Entropy aside, if your password were compromised, and it was "HorsesLikeToEatApplesAndStaplesForLunch" changing it to "HorsesLikeToEatApplesAndStaplesForDinner" would be much worse, then changing "^&*@Y#UKFJLDSJW" to "^&*@Y#UKFJLLREW" because the later is not a guessable sequence– n00bNov 16, 2016 at 21:47
Iterative improvements of a password is weak if the adversary has access to any data which lets him validate older passwords.
For instance an old copy of your password storage can be decrypted using the old password. Once this password is known to the adversary he can try variations of that password to decrypt a newer version of the password storage.
Same methodology can be used if the attacker rather than a file encrypted using the password has access to a salted password hash.
So unless you can reliably wipe every copy of every file which could be used to validate your old password, then a new improved password based on the old password is not much more secure than the old password.
Ways in which an adversary could get access to such old files include:
- Backup copies
- Remapped sectors on a hard disk
- Spare sectors for wear leveling on an SSD
