I had been using a password manager for a while, But my Bitcointalk account outdated my password manager usage, so I never generated a password for it, was too lazy, learned my lesson the hard way.
Glad to hear it. Good luck keeping your accounts secure, especially now that you have
a Platinum account. You wouldn’t want for anyone to steal Star Platinum!
Password managers are only for the dumb and demented geezers who can't properly memorize a few hundred of unique, secure passwords (say >10 chars, including upper/lower, numeric and special chars and no known words).
LOL.
Oh, by the way, 10 chars? Considering only random case-sensitive alphanumerics, since many sites choke on special chars:
$ bc
l(62^10)/l(2)
59.54196310386875208867
A Hashcat guru would need to chime in with some numbers on the cloud-cracking GPU cost to bruteforce it. Pretty high, I guess—but not high enough for my tastes, especially not with many sites using SHA-256 (or MD5). It is definitely within the realm of feasibility for hardware that humans are capable of producing, without requiring enough energy to boil the oceans.
Too short.l(62^20)/l(2)
119.08392620773750417735
Wow. Not being cracked by Hashcat! I know that at least one of the popular password managers uses 20-char passwords by default. I won’t name it, because it’s a closed-source cloud thingie, and I recommend
avoiding it; but that is a reasonable default, IMO.
l(62^40)/l(2)
238.16785241547500835472
The security margin here is basically free, so why not? Use long passwords on sites that allow that; use max-length passwords on stupid sites that limit you to 12–16 chars, or whatever.
Yes, I am inappropriately misapplying Shannon entropy. Most people commit this error when estimating password strength. If we are treating passwords as random strings, what we really want to know here is the min-entropy. Most people make this mistake from ignorance; I hereby do so from laziness, and because once we get up to a 40-char password, the security margin is so astronomically huge that none of this makes much of a difference.
Also, if your password manager uses a bad algorithm to transform random bits into an alphanumeric string (or whatever), there can be a significant bias; in the wild, I have seen password manager code that will easily let you lop off 30% of the search space, if you know (or can guess) that the target used that particular password manager. Astronomically huge security margins do help here: Losing 30% of the search space for a 10-char password could make a real-world practical difference; losing 30% of the search space for a 40-char password is only a theoretical problem.
* nullius 8> security margins (within reason).
That's the same sort of pussy dimwits that needs to write down their seed phrase. *shaking head in disbelief*
My brainwallet is “correct horse battery staple”. I will not forget it! And it is such a nonsense phrase, nobody will ever guess it.
Real men have a photographic memory and don't need crap like password managers, paper wallets or backups. Or do you really think Chuck Norris would use a password manager or backup data?
* psycodad ducks, runs and goes backuping his passwordsafe database files..
A .sig I that once saw on—I think it was actually on Usenet, though I don’t recall:
“Real Men don’t do backups. Real Men cry a lot.”* nullius programs his custom password manager by punching hex opcodes into the front panel, because Real Men don’t use compilers or assemblers or pussy hand-holding n00b stuff like that.