Feature Suggestion

oocelik

It would be great if we can enter the master password by the voice. I chose the longest and secure password for the master but i notice it becomes very difficult to enter it all the time. We can just have it in addition to entering with the keyboard.

svondutch

I wouldn't recommend speaking your master password out loud, but I believe Windows comes with built-in speech recognition, where you can dictate text to the computer.

http://windows.microsoft.com/en-us/windows/set-speech-recognition

DBrown

My master password is so full of special characters that it's hard to imagine how I would pronounce it. :D

svondutch

My master password is so full of special characters that it's hard to imagine how I would pronounce it.

This is why diceware is such a nice alternative. A diceware passphrase is strong, yet easy to remember for a human being. And pronounceable.

DBrown

I still prefer gobbledygook for my master password. It makes sense to me and to my spouse, but there's no way it'll show up in any dictionary. :)

RichardPayne

Sure they do @DBrown. It's called the alphabet. ;-)

DBrown

Perhaps, but only if I used only alphabetic characters, which would make for a much more guessable master password. I'm certain that my master password doesn't appear in any dictionary. (That's one of the reasons diceware passwords don't appeal to me.)

My master password, like any other string of characters, no matter how long, could eventually be guessed. The question is whether I, my spouse, my children, or even their children (it could happen) will still be alive by the time a bad guy got it. If the answer to that question is even "Probably not," my data is secure enough for me. :)

RichardPayne

I'm getting a sense of deja vu. Have we had this conversation before?

Being in a dictionary is irrelevant if the dictionary is large enough. My previous point about the alphabet was not meant to be taken literally. If you look at it in terms of available characters, you have 26 upper case, 26 lower case, 10 digits and a smattering of symbols. Let's call it 80 symbols for sake of argument.

A normal password is 12 "characters" chosen from a dictionary of ~80 "characters".
A diceware password is 6 "characters" chosen from a dictionary of 7776 "characters"

12 "characters" from 80 choices = 68.719x10^21 permutations
6 "characters" from 7776 choices = 221.073x10^21 permutations

So a 6 word diceware phrase is roughly equivalent to a 12 character password (using lower and upper case, digts and symbols).
Both are in the 2-3 million years to crack range. Should be good enough, and that's not even taking things like PBKDF2 into account.

My point was that normal passwords use a dictionaries (of 80 values) too and it's much smaller than that used be diceware. They just make up for the small dictionary size by increasing the number of characters used.

DBrown

Have we had this conversation before?

:D Quite possibly.

My previous point about the alphabet was not meant to be taken literally.

Sorry—I tend to do that with words.

Both are in the 2-3 million years to crack range. Should be good enough, and that's not even taking things like PBKDF2 into account.

Yes, that was exactly the point I was making above.

I also find my master password easier to remember and much easier to type than anything I've seen come out of a diceware utility. I'd end up leaving my vault open longer, just to avoid having to re-enter it. Also, my spouse would need a much more complex hint to remember a six-word phrase. (1Password for Windows doesn't include a master password hint, but she has access to my vault through 1Password for Mac.)

Thanks for the interesting conversation!

RichardPayne

Interesting. I find 6 words much easier to memorise than 12+ random characters.

DBrown

Oh, I never said they were random, only that the string doesn't appear in any dictionary and that no one would ever guess it. I've used it since I started using 1Password (version 2 for Mac), so it's in my fingers—nothing to remember—though I could always get the hint I left for my spouse, if I needed it.

RichardPayne

I've used it since I started using 1Password (version 2 for Mac), so it's in my fingers—nothing to remember

Now that I can understand. Change, of any sort, has a high impedance.

DBrown

:)