J
I'm really enjoying the password discussion as it's a few ideas I've been pondering myself.
Just for reference, I made the move to Keepass a number of years ago. For each service I used at the time, I made a pretty long pseudorandom string using all possible characters allowed for each service (some didn't allow spaces or certain symbols in passwords at the time, etc).
I don't use a browser I don't trust, but I've never stored passwords in the browser. If the browser gets compromised, my passwords would be compromised. Browsers are more likely to be compromised as they're the internet-connected bit of software, not the password manager. Additionally, in the spirit of "stick to what you're good at", browser makers make good browsers, where password managers are a secondary feature. In contrast, password-manager makers make password-managers, so focus all their effort on engineering their password-manager. I'd rather use a browser to browse, and a password-manager to password-manage.
Occasionally I'm on a borrowed computer that I trust, and I have to open my password manager on my phone, attempt to read it, and manually type in a whole password into a web site. It's a complete and utter pain, but it's possible if you're slow, patient and persistent! It's especially troublesome if you're not sure if you're reading an "0" or an "O", or you use a foreign keyboard where the symbols are different...
I've often wondered whether some sort of more human-memorable route is the way to go, but worried about entropy and ease of guessing. My concern with using dictionary words is that you can brute-force a password made out of dictionary-words by considering every word as a "character". Of course, the entropy is still extremely high because a dictionary contains far more words than the alphabet contains characters, so the potential search space is much larger. It's nice to see these concerns compared and somewhat quantified. I still think it might be possible to take a shortcut by using the laws of a language to guess a password that may or may not contain dictionary words. For instance, if you know the password might contain English words, instead of just trying "Q", you could try "QU" and you've potentially guessed 2 characters in the space of 1. For German words, when guessing "U", you could perhaps guess that it's the end of a word ending in "UNG", and you've potentially guessed 3 characters and identified a word boundary...
It's certainly made me think. At the moment, I think I don't have a bad solution, as the random characters/numbers/symbols and length assure me a reasonable degree of entropy - but there's got to be a way of making it slightly easier for me as a human without making it significantly easier for a computer to crack it.
