Diceware Passwords using two languages. Good Idea or bad?

Aeon

Its time to change my master passwords again. The old ones are not cutting it anymore.

I have been looking into Diceware Passwords after seeing them recommended here and by that xkcd comic.

I am speaking two languages: English and my native language.

I though I roll the numbers as per the Diceware manual but would use two different word lists (English and another language) note down the words and then when assembling the final password I would choose from which language I would use the word.

Example using placeholders not actual words or dice rolls:

I rolled something like this:

# - English - other language
1   -  a  - q
2   -  b - w
3   - c  - r
4   - d  - t
5   - e  - g
6   - f  - k

a and q would be the words corresponding to the rolled number #1 on the two used diceware wordlists.

so when assembling the password I would go down the list and choose for example the words:
a w r d e k
and make my password with that.

My big question now:

would doing that decrease the entropy? security? (not sure which word is correct here) of the password?

Or to say it differently:
Good Idea or bad Idea?

[deleted]

I just use a password generator to get a 21 character password use Microsoft Authenticator to save for autofill.
Have tried 2fa passkeys but I don't understand how they work, also MA doesn't save passkeys and passkey apps don't import passwords.

Aeon

[deleted]

All my passwords I use online are in a Password manager and are auto generated and at least 20 characters long.
What I want is to change out is the passwords that is the master passwords for my password generator, 2fa authenticator etc.

Passwords that dont leave my local machine. I try to change them every couple years and recently I learned about diceware passwords and though this might be a good way to get passwords you need to actually remember and that need to be reasonably secure as they guard everything else.

And yes my password vault is also secured with 2fa.

Salpha

You are using two word lists from different languages for your Diceware password is a good idea. It maintains or even increases entropy and security. This adds complexity, making the passphrase harder to guess. Therefore, it's a strong approach for creating secure passwords.

mmmm

@Aeon if youre saying that your 10 character passphrase (for example) contains a mixture of words from two different language lists, then yes - so long as you correctly rolled the dice according to the instruction and therefore gained as much entropy as possible then it will at least be as secure, certainly not less.

Edit**
It does depend how you pick the final words though I suppose. Picking anything at all defeats the point and will lessen the entropy technically. Why dont you roll the amount of words you want and just alternate the lists you pick from? Omitting any self made decisions from the words you use is the only way to do it properly.

Aeon

mmmm

good idea and thank you for pointing out that picking anything is not ideal.

instead of choosing which word from which language I just roll a dice and if its odd I go with English and if its even I go with the other language.

example:
I go with a 6 or 7 word passphrase.

I use two diceware lists of different languages.

I roll 5 dice 6 or 7 times.

then I roll for each rolled number another die and check for odd/even to determine from which of the two lists to pick the word from.

and then as last step I assemble the passphrase from the two lists according to the dice results.

The only things I choose with this method are the lists I use and the number of words used in the passphrase.

mmmm

Aeon that sounds like it keeps the randomness which is the point, good idea!

mmmm

Double post

Blastoidea

How do you derive your word lists?

I hope it isn’t a dumb question.

Aeon

Blastoidea

There are word lists online for diceware.

I follow this manual for making diceware passwords:
https://theworld.com/~reinhold/diceware.html

There are Wordlists linked for english and multiple other languages.

Blastoidea

Aeon Thank you very much.

matchboxbananasynergy

Blastoidea The most popular wordlist (and the one I would recommend) is the EFF large wordlist. The passphrases made using that list tend to be longer in length, but that's because the words in that list have been chosen for memorability at the cost of the words being on average a bit longer.

https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt