12

I'm reading about Diceware and cryptography in general and I know how secure Diceware can be. I stumble upon this part on The Intercept about Diceware and it says:

"You don’t so much need them for logging into a website or something else on the internet. In those situations, you get less benefit from using a high-entropy passphrase. Attackers will never be able to guess a trillion times per second if each guess requires communicating with a server on the internet. In some cases, attackers will own or take over the remote server — in which case they can grab the passphrase as soon you log in and send it, regardless of how strong or weak it is cryptographically."

So the question is, is it overkill to use Diceware on accounts like Facebook, Twitter, etc.? Should I rely on a password manager generating a random string of characters for these accounts and reserve my Diceware passphrase as a "master password" or a secret PGP key?

  • 17
    You're better off using a password manager for your online passwords and use diceware as master password for that. – MechMK1 Jul 26 at 9:14
22

The reason why you need a strong password for an online service is in case their database is compromised, and the attacker gets hold of the password hashes. Then the attacker can indeed make a trillion attempts per second (if the hashing algorithm is weak and the attacker has good hardware) against your hash. A database compromise won’t necessarily also give the attacker complete access to the front-end servers and network to be able to capture actual passwords as they’re entered.

| improve this answer | |
  • This reason only applies if you're following the poor practice of using the same password for multiple online services. If you aren't, then attackers have nothing to gain from cracking your password, which only provides access to that same service that they have already infiltrated deeply enough to get to the passwords. The edge case is an attacker who has is specifically targeting you and who infiltrated the system specifically to crack your password, so be able to then surreptitiously log in as you for an indefinite period of time. Stuff of fiction, mostly. – Kaz Jul 28 at 0:30
  • @Kaz That’s not necessarily true. An attacker who has got a three-month-old database backup that was mistakenly stored unencrypted on an unsecured cloud system hasn’t got any kind of deep access to the target site, but can breach your account if and only if they can crack your password hash. – Mike Scott Jul 28 at 5:41
7

The purpose of passphrases is to have a strong authentication factor that is easy to remember. If you use a password manager you don't need to be able to remember your passwords, so in most cases you don't need passphrases at all.

The point about online services is a separate one, and it applies to both passwords and passphrases. Basically, for logging in to remote services, often your passwords don't need to be extremely strong. The reason is simple: online bruteforce attacks are way slower than offline attacks, plus several services today also implement other security controls (rate limiting, 2-factor authentication, geolocation, alerts, etc.). However, if you are using a password manager this point is moot: the password manager lets you use strong passwords in every case, without complicating the login process at all.

| improve this answer | |
  • 2
    Well you might need one passphrase for a password manager. (re: your first paragraph) – David Z Jul 26 at 22:13
2

All passwords should be generated by a computer, because humans are very good at introducing patterns that weaken the result :-) If you have no trustworthy computer available, then literally using dice and the Diceware method for generating a wordlist/passphrase is a great alternative ... "a computer" doesn't have to be electronic!

Many passwords can be handled completely by a trustworthy password manager application, so that the human never needs to type those in. Choose as long and as complex a password as possible for each account, because you have no reason not to. 64 characters selected from upper, lower, numeric, punctuation and anything else the target account/site will accept will be overkill in terms of entropy, but it shouldn't matter because it's as easy for you to use as any other password. If the target has a shorter maximum length, just generate the longest they'll accept.

Some passwords are better off memorised by a human so they can type them in directly - e.g. the password manager unlock password, as well as others you might use regularly. These should be generated as word lists/passphrases, in the same manner that Diceware does. But your password manager should also be able to generate passphrases in this form, so you might as well use it.

For word lists/passphrases, you still have to worry about the length - but this is now a combination of the number of words and the size of the word list used. Diceware recommends a length of 6 words, larger lists can theoretically give you equivalent entropy with fewer words, but really we're now competing with human memory, which is actually pretty good, so again you should go with the longest passphrase that is practical to use.

In summary - there's nothing superior about passphrases compared to passwords in terms of math, but they are superior in terms of getting humans to effectively remember and input longer sequences of characters, and password security is basically all about length.

But it is overkill to sit there rolling dice if you have a trustworthy computer and password manager already available.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.