Passphrases are not passwords and I think they shouldn't be recommended for use as passwords.
Passphrases are fantastic for encryption keys, where trying to otherwise memorise a suitable amount of entropy to match the required strength would be almost impossible.
But passwords don't need to be 256 bit. If you're using a password manager it doesn't hurt to keep passwords as strong as each service will allow, but Diceware isn't the right tool for the job for passwords, because while it's great for memorizing one or two high entropy phrases, there's no way someone could be expected to memorize the dozens of passwords they use on a daily basis.
At which point you're back to bad solutions such as writing it down, using the same phrase everywhere or cheating on the lengths.
The only sane way to manage dozens of services in a way that doesn't bleed risk from one service compromise to the next is password managers.
At which point a 16-20 character password of random characters is more suitable than a passphase. It's harder to memorize if anyone happens to see it due to a miss-paste or whatever, it's easier to type in if you need to and it's less likely to suffer from "silent truncation" effects.
So use a password manager, use a diceware phrase to secure the master password (encryption) there, but allow the password managers to generate passwords which are short and random.
Diceware is not suitable for general use, because it is important to have a unique password on every service. That practice isolates you from the damage of sites like LinkedIn and Dropbox being compromised.
If you use diceware for everything you've got to remember all of those unique passphrases which defeats the whole point of diceware.
Where diceware shines is in creating a master password, which is explained in the guide.
Comments
Just use diceware. Simple and effective.
http://world.std.com/~reinhold/diceware.html
Diceware is great for passphrases.
Passphrases are not passwords and I think they shouldn't be recommended for use as passwords.
Passphrases are fantastic for encryption keys, where trying to otherwise memorise a suitable amount of entropy to match the required strength would be almost impossible.
But passwords don't need to be 256 bit. If you're using a password manager it doesn't hurt to keep passwords as strong as each service will allow, but Diceware isn't the right tool for the job for passwords, because while it's great for memorizing one or two high entropy phrases, there's no way someone could be expected to memorize the dozens of passwords they use on a daily basis.
At which point you're back to bad solutions such as writing it down, using the same phrase everywhere or cheating on the lengths.
The only sane way to manage dozens of services in a way that doesn't bleed risk from one service compromise to the next is password managers.
At which point a 16-20 character password of random characters is more suitable than a passphase. It's harder to memorize if anyone happens to see it due to a miss-paste or whatever, it's easier to type in if you need to and it's less likely to suffer from "silent truncation" effects.
So use a password manager, use a diceware phrase to secure the master password (encryption) there, but allow the password managers to generate passwords which are short and random.
Diceware is not suitable for general use, because it is important to have a unique password on every service. That practice isolates you from the damage of sites like LinkedIn and Dropbox being compromised.
If you use diceware for everything you've got to remember all of those unique passphrases which defeats the whole point of diceware.
Where diceware shines is in creating a master password, which is explained in the guide.
Another descriptions of Diceware https://theintercept.com/2015/03/26/passphrases-can-memorize...