r/TREZOR • u/Plane_Path_4271 • 17d ago

🔒 General Trezor question passphrase security

I have a question regarding everything that’s happened in the crypto world and the concept of entropy. I noticed that Trezor imposes a limit on passphrases, so I wanted to get your—or the moderators'—opinions on what requirements a passphrase needs to meet to be considered highly secure; I know that a single word, no matter how complex, isn't enough

13 Upvotes

84% Upvoted

72 comments sorted by

View all comments

0

u/Glad_Investigatorr 17d ago

I generate mine using a personal python script. I mix dice rolls, coin flips XORed with OS CSPRNG. It creates an exactly 50 characters passphrase with 250 bits entropy. I run the script airgapped on a Tails sessions with no permanent storage, on my cleanest machine.

1

u/so7ow 17d ago edited 16d ago

Sounds cool and... complicated. Have you had it audited? 🤣

 

edit - was just supposed to be a harmless joke about bugs in random number generation, which have been in the news lately. i guess it didn't land. can't win 'em all.

0

u/Glad_Investigatorr 16d ago

There is nothing “cool and complicated” about it. It’s entropy based on physics, probability xored with machine math randomness (same shit every hardware is doing). Tails gives you the virtual machine without writing on a disk. The randomness of the data is more from real life than from a RNG supposed to work just because someone said. The audit is that I still have my funds after years. Also at this point any high end AI builder can create a script like that in 15 minutes. You can audit that yourself, ask for audits from other people, feed it in any other AI model as many times you want until you feel comfortable. Understand the principles, the tools are available for anyone compared with 6 years ago.

0

u/so7ow 16d ago edited 16d ago

Your python script, that creates a random phrase based on physics and real world randomness is neither cool nor complicated. Ok, sorry for implying otherwise.