Hundreds of years to thousands of years might be enough difficulty, perhaps?
In some cases the length of the search space really matters, especially when you use
the "pattern" approach. My passphrase that extends SEED is 32 characters long
filled with small letters, cups, digits and special characters, and at the same time there is no effort for me at all in reproducing it even with my eyes closed because I use Gibson's trick.
I had to look up Gibson's trick and I think that it is good up to a point- even though it takes away from some randomness, but the filling in of characters likely ends up helping with difficulties to guess the password by others or difficulties to break by password guessing machines.
For example, sometimes we might have created some passwords and then we cannot remember the exact details of how we had varied the base word(s), so maybe if the password base starts out as:
Great Mary
So then we try to consider how to vary our base word, so then maybe we might vary it, yet without practice we cannot recall the exact details of how we had varied it. Maybe the end result looks like this:
34gGgGr88ea88t##mMmM@@ry43
That seems pretty hard to break, even though it is not random, and we might have to create some kind of a note to ourself to remind us of our password and how we had varied our password within some formula that we will remember based on a note to ourself, no?
The passphrase does not even have to be very long in order to get somewhere between light orange and dark orange, and yeah of course, guys might choose even higher levels of protection.
That's if it's totally random characters, adding a dictionary word can be used as an attack vector even if that word is 10 letters long.
Then the chart can be used for the additional symbols and numbers in consideration of how many dictionary words are currently available.
But since NotATether said 12-24 "
words" long, that length is practically a requirement since otherwise, it'll be susceptible to dictionary attack.
- NEW: You should definitely use BIP39 passphrases for your seeds. In fact, if I were you, I'd make it at least 12 or 24 words long, just like your seed.
Alternatively, just make it a combination of real words plus random letters, numbers and symbols so it wont have to be 12 words long to be strong against bruteforce.
Either way (
12-24 word passphrase or that), the user has to write it down on a separate paper anyways.
I think that it is good to make clear that there is a difference when we are talking about our passwords and our passphrase.
The recent Coldcard issue ended up causing the initial passwords to be easily crackable, so then the passphrase ended up giving a second layer of protection, and of course, if we knew that our passwords were going to be so vulnerable, then we need even higher levels of protection for our passphrase.
I doubt that in normal cases we need our passphrase to be treated the same as our passwords so 12 characters or more with a combination of characters, numbers, letters, and capital letters is better, even though maybe there might be some lacking in our randomness in the sake of our also wanting to have some abilities to have some memory of it out of convenience and also not wanting to lock ourselves out of our own coins. And, surely our own level of paranoia might cause us a lot of inconvenience if we end up overdoing it.
Hundreds of years to thousands of years might be enough difficulty, perhaps?
It depends
A password that would have taken thousands of years to crack in 1990 won't be secure now, and the same can probably be said for a password that's currently safe if you add another 36 years of computing improvements.
I'd say this is an argument for using much heavier encryption: BIP38 for instance is still
very expensive to brute-force. Passwords become annoying to type and remember if they're too long. If "one attempt" takes 0.1 seconds, an attacker can't test millions of even billions of passwords per second.
Anything that takes a "normal" hacker a thousand years to brute-force, will still be peanuts to someone with (very expensive) access to an (AI) data center.
I agree that a lot of us are likely rethinking the level of complexity of our previous passwords and the extent to which we need to improve them for modern times, as the times are ongoingly evolving.
