When there's a breach … when talking to to someone with a genuinely random password – eg one generated by a good password manager – is it fair to say you are probably safe?
Theoretically, yes (under a truckload of assumptions).
- you are a private person (not representing a company, organisation, or institution)
- you only transmitted your password over a secure connection (HTTPS) each and every time,
- the breached site actually hashed your password using an according, well-vetted, unbroken, cryptographically secure slow hashing algorithm (like Argon, bcrypt, etc),
- the site only stored the password hash (and not your password in plain text),
- the server code contained no security glitches which might have leaked your password,
- no other security breaches took place and no other attack vectors were exploited successfully,
… and, last but not least, assuming …
- the attacker is not one with unbounded memory and processing power,
- the “breach” limits itself to the attacker only grabbing a copy of the database where password hashes were stored (and not some rogue employee or something alike)
… then your question practically boils down to: “Is a random password more difficult to attack using rainbow tables et al?”
In that case and under all those assumptions, the answer is “Theoretically, yes.”
Compared to dictionary-alike passwords your password will be securer as the chances an attacker has pre-calculated dictionary passwords are higher than the chance the attacker has pre-calculated a garbled sequence of characters. If the website developers did their job correctly, they also used salts et al – which makes things even more difficult to the attacker and somewhat voids all precalculation efforts of an attacker.
Yet, if the attacker is a state or nation, those chances reduce to a near-zero level. Also, the above relies on a truckload of assumptions. A small thing like not using a salt when hashing passwords can make things more insecure than any attacker could wish for. Similar problems arise if the website backend didn’t use a slow hashing function (Argon, Bcrypt, or alike) for your password. All that can and will have an impact on the safety you expect from your random password.
When a site has been breached, the breach itself mostly turns out to be merely the tip of a much bigger security-problems iceberg and such attacks rarely limit themselves to a stolen database full of password hashes.
If you have reason to believe your password has been stolen or compromised in any way, you should change it, and make sure you change it on all of your accounts where you use the same or a similar password. To simply rely on the fact that a breached website did not have other attack vectors wide open would not really be a smart move.
See… in the event of a breach, the fuse of the bomb has been lit. Just because you happen to have a longer and/or better fuse doesn’t mean you’re safer than others. It merely buys you a bit more time until things blow up. If the website developers did their job right, that detonation may take decades to come… but if someone managed to breach the website, chances are the developers did something (if not everything) wrong.
Therefore, changing your password as soon as possible is the safest/smartest thing to do in the event of a website breach. Especially, since you never know where website programmers may have dropped the ball and thereby introduced other security glitches in places that might or might not have an influence on the security of your password and/or other credentials.
Generally, a good password policy will push you towards refreshing your password(s) in case of a breach (as well as in some other situations). Besides, as part of your personal key management, you should be rotating (read: refreshing, renewing) your passwords on a regular interval anyway – as doing so can be “beneficial for reducing the impact of some password compromises”
(but not all). Since you mentioned a password managing app, chances are that it contains according functionality allready. Even if it doesn’t, it’ll surely make a password change easier than constantly wondering if the attacker was able to recover your password or not.
But in the end, it’s a matter of personal opinion if it is
fair to say that
you are probably safe when having used a (let’s just call it) "more random password", as that strongly depends on the individual scenarion and what exactly you mean when writing
So, wrapping all this up in a final, concluding answer: “A more random password could be safer compared to less random passwords used by other users when an attacker tries to reverse/break the captured password hashes, but you should definitely NOT rely on your password being safe on the long run. Change your password nevertheless when the related website was breached as it’s better to be safe than sorry!” Most of the time, websites will ask you to do so anyway after they’ve detected a breach and closed related gaps.
Related to your question, you might also be interested to check on the ftc.gov article Time to rethink mandatory password changes; especially the “When should passwords be changed?” part.