I use LastPass comprehensively, and for each new site/password I almost always have it generate a random password of the same number of characters, allowing letters, numbers, and symbols (except when prevented by password forms that disallow that length or certain symbols). Today, it occurred to me that using the same password length everywhere could itself be an issue.
Let's say a malicious agent owns a site that I have registered at, and has kept the original password. Just seeing the password would make it obvious that I'm probably using a random one. But if that site maliciously wished to target other accounts I may own, and he guesses that I generally used passwords of the same length, he might have a leg up on brute-forcing my password at other sites. Therefore, would my using a variety of lengths yield appreciably more security than using just one length?
It's convenient to not change the number of characters that LastPass generates. And most sites do have a limit on the number of characters which is lower than I'd like. I also don't want to just add more characters for no reason, because occasionally I do have to type one of these passwords on my mobile phone. The other day when a site said the password length limit was 60, intrigued, I created a 60-character random password, But later, I had to type this password on my phone and while I did it correctly on the first try, it was a lengthy and painful process.
It occurs to me that just adding some number of characters to my typical length will probably provide all the extra entropy needed to remove any weakness from an attacker knowing I use the same length anywhere. But I'd be interested for some knowledgeable people to comment on this.
How many extra digits need I use so that my passwords are as secure as using a variable number of characters? For example, if I were using 15 characters all the time, how many more characters would I have to add to have the same entropy as if I normally randomly used 10-15 characters? Though, the security of 10 characters feels too low in the first place, and always using 15 seems safer. So I'm conflicted.
What's a reasonable way to look at this? Should I:
- Use different lengths at different sites
- Increase my characters (I don't use 15, but some other number)
- Or just don't worry about it as long as my length is sufficient (and what length would you say is sufficient to be theoretically uncrackable* for the next 20 years)?
For what it's worth the full character set LastPass uses is 70 characters:
Re: uncrackable: I realize the crackability of a site is not just dependent on the password itself, but also on the site's security practices such as means of storage, whether it keeps the original password or a hash, the particular hash algorithm and its number of bits, whether the attacker has gained access to the hash, whether the hash is salted and the attacker knows the salt, whether the site rate-limits or locks accounts after experiencing apparently hostile attack behavior, and so on and so forth including the vigilance and knowledge of its employees to resist social engineering and all the rest of that jazz. This question, instead, is merely about the scenario where the only attack vector is to try every possible password and see if the site accepts it.