Their feature set seemed calibrated for the truly paranoid cypherpunks, and I rolled with it.
Then I began taking a critical look, and the first thing I noticed was that their dev team was a bunch of nobodys with creepy aliases and mostly seemed based in the E.U., definitely not USA/5 Eyes or anything.
Okay, well, critical security component is controlled by Euro-spooks, no problem...
I never seemed to have any password manager-related problems, except...
I often opted for generation of a "five word passphrase" like the xkcd recommendation, and I would go back and type in those passphrases, and they seemed almost insultingly accurate. Like if I didn't know any better, my identity or personal attributes were carefully encoded in the passwords themselves.
I am sure I was imagining things, [over-the-top with my tinfoil hats!] but eventually I moved past needing KeePass, and into the native managers offered by Microsoft/Google. Interesting times, for sure.
Advice I got soon after discovering the internet in 1994; still valid.
1. Not the online pseudo-diceware stuff, real dice.
Of course I remember.
Correct me if I’m wrong, but doesn’t this mean that up to 77.5% of passwords known to be exactly three words can be cracked using a 30% common-word dictionary subset?
3np•9mo ago
https://xkcd.com/936/
drweevil•9mo ago
tuatoru•9mo ago
Perhaps because it is so simple: what matters for passwords is length. No other complexity metric (codeset, whatever) is even in the same race.
Personally, my passphrases are seven words or more, which gets me to over 30 characters.
3np•9mo ago
"qwertyuiopasdfghjkl" or "aaaaaaaaaaaaaaaaaabc" are not stronger than "kmY7$®f0V".