# Ideal passphrase length: old diceware method (5 words) vs. your Bitcoin wallet.dat passphrase lenght (8 words) and doubling passwords?

I made a cool 5 word passphrase back then using the old Diceware method and use it as a master password. The question is as computing power increases will we need to add more and more words to our passphrases which we will eventually forget? I'm in my mid 30s, will passphrases be enough in my lifetime? :) So back then, Diceware suggested just 5 words, not the original Bitcoin QT client recommends 8 words. Will theoriginal 5 words from the Diceware age will serve me in the Bitcoin age?

I don't really want to mess around with a Yubikey. Heck, I Googled it and didn't really managed to find out what it is, what it does. Maybe I'm not the target market. I'm just a simple user. Carrying around a Yubikey would also be a red flag in my eyes. He has secrets!

How effective is doubling a passphrase? Like I have now [passphrase] and simply doule it: [passphrase][passphrase]. So I don't really have more stuff to remember, just more stuff to type. That might serve me for a time.

Oh, another interesting question as well: let's say I use one exact password on many similar forum pages. Will this generate the exact same hashes if they use the same forum engine? I know, you can't recover the password from the hash, but they may find same hash = same guy, right?

-

I made a cool 5 word passphrase back then using the old Diceware method and use it as a master password. The question is as computing power increases will we need to add more and more words to our passphrases which we will eventually forget? I'm in my mid 30s, will passphrases be enough in my lifetime? :) So back then, Diceware suggested just 5 words, not the original Bitcoin QT client recommends 8 words. Will theoriginal 5 words from the Diceware age will serve me in the Bitcoin age?

Bitcoin (well, the wallet software, anyway) is being a bit conservative. A 5-word passphrase might be a bit on the low side, but if your words have been chosen randomly from some dictionary with about 7.5k words, as claimed on the Diceware page, you should be safe, as this comes out at roughly $64$ bits of entropy. This should remain a strong passphrase for the next decade or two at least, but there's no real way to know. You'll probably be fine anyway if you're not a high-value target. Most attacks today are done against a large batch of weak (and weakly protected) passwords, not a single strong one.

How effective is doubling a passphrase? Like I have now [passphrase] and simply doule it: [passphrase][passphrase]. So I don't really have more stuff to remember, just more stuff to type. That might serve me for a time.

It doesn't really help all that much. You're not adding lots of uncertainty to the new passphrase, you just doubled it. Now that this question is on the public internet, an attacker trying to target you might try every combination of 5 words, and then double them and try again, just in case you doubled your passphrase. This means the attacker will have to work twice as hard to obtain your passphrase, not very useful. Adding a single Diceware-grade word is considerably more effective.

Oh, another interesting question as well: let's say I use one exact password on many similar forum pages. Will this generate the exact same hashes if they use the same forum engine? I know, you can't recover the password from the hash, but they may find same hash = same guy, right?

It depends. In an ideal world.. no. The hash functions would be different, and they would use a random salt anyway. But, in the real world, yes, it's quite likely that many forums out there are still using MD5(password) and in that case, the same hash will end up in multiple databases, which is bad.

But if a forum engine is well-designed, that should not happen - each user will be given a random "salt" to differentiate his password from other users', this means if you create the same account on two different forums (even using the same forum code) you will most likely be given different salts, which'll make the two hashes differ.

I don't really want to mess around with a Yubikey. Heck, I Googled it and didn't really managed to find out what it is, what it does. Maybe I'm not the target market. I'm just a simple user. Carrying around a Yubikey would also be a red flag in my eyes. He has secrets!

Everyone has secrets, and people carry around authenticators already, don't they? :) Basically, it's a two-factor authentication token. When you log into a website, you usually only use one-factor authentication: you know your password. But in a two-factor authentication process, you need to provide what you know (password, passphrase) and something else, either of:

• what you are (biometric fingerprint, retina scan)
• what you have (a physical object, such as a security token)
-
Thanks Thomas! (Should I write "thanks" under a useful post or it just uses space on the Internet? Now that this question is on the public internet, an attacker trying to target you... But actually I'm not a real person. That might help. – superuser Jan 7 '13 at 7:25