![]() Thus, the "most secure master password" would consist of 20 words from Bitwarden's generator, providing 258 bits of entropy. There is no point having a master password that has more entropy than the account encryption key (256 bits), or else an attacker would just brute-force the account encryption key directly, and by-pass your master password. I want the most secure master password I can have. Some users prefer 5-7 words, which would provide 65-90 bits of entropy, but this is typically not necessary unless you are a high-value target (or just paranoid highly security-minded). A 4-word passphrase (e.g., hacksaw-regretful-resemble-durably) will do nicely, with 52 bits of entropy. In this case, you really only need about 50 bits of entropy. I am not a high profile person just an average Joe. Common passphrase generators (including Bitwarden's) are based on word lists that contain 7776 words, which results in a passphrase entropy of about 13 bits per word. So the only question is - how much entropy do you need/want? This will determine the number of words to select for your passphrase. There is no need to play games with adding numbers, captialization, or special characters, as Bitwarden has no such requirements for the master password (and all this does is to make the password harder to remember and harder to type, all for a very minimal gain in entropy). To increase security of the password (which we typically measure in "bits" of entropy), just increase the number of words in the passphrase. ![]() Use a passphrase generator (use Bitwarden's generator with Type=Passphrase, or choose among many other available online passphrase generators). Your master password should be created for you by an algorithm that uses a random-number generator or another source of entropy (such as dice rolls or coin tosses). Second, if you truly "want the most secure master password" possible (and not just a pat on the back for your creative method of constructing a password), you should not "make" your master password. They are all wrong (some much more so than others). First of all, don't trust any password strength testers, including Bitwarden's. ![]()
0 Comments
Leave a Reply. |
Details
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |