Hacker News Reader

Comment by asutekku | Hacker News Reader

Honestly, 90 digit password is only harder to type for you. It’s not more secure than only in theory when compared to, say, 20 digit password.

View on HN

I choose to have the highest level of security I can afford, of course there are diminishing returns with each layer of security. Im happy to see evidence that a long password is only secure "in theory", until then I will keep my strategy. I can type 100WPM and this password is based off ~uncommon words, so I'm not uncomfortable: I didn't complain about entering, I claimed the issue is 1 wrong character requiring typing the whole thing password. It only takes a few seconds, but it is frustrating to type the whole thing again (regardless of length).

https://xkcd.com/936/

Well, considering the LastPass master password is stored as a 256bit string on the servers, your 90 character master password has 720 bits making it considerably more its that make up the hash thats stored on the servers! 1 ASCII character is 8 bits!

You don't understand encryption. The master password is not "stored as a 256bit string on the servers".

Yeah it is!!

LastPass stores our master password hashes as a SHA-256 bit key.

All I was quipping at, was the fact that the password you enter in length is a whopping 720 bits!

I find it funny that this bit length gets reduced to a hash which is only 256 bits in length.

Your password has more entropy than the hash that gets produced from it.

Reply on news.ycombinator.com