4 ms·
The fact that it is still a central point of failure that contains the keys to the kingdom is worth noting. It occurs to me as I write this that for most peopl
by TrevorJ 11y ago
The fact that it is still a central point of failure that contains the keys to the kingdom is worth noting.
It occurs to me as I write this that for most people compromising an email account would be just as disastrous, given how many services rely on a simple email for password recovery/resets.
- rkuykendall-com 11y ago> The fact that it is still a central point of failure that contains the keys to the kingdom is worth noting. I think the difference between someone who uses a password-manager user, and the vast majority of people who don't, is that those who don't have HUNDREDS of points of failure that contain the keys to the kingdom, some completely insecure.
- deleted 11y ago[deleted]
- morsch 11y agoHardly. "Keys to the kingdom" seems to imply that access to the key opens up a large number of other doors. That's the case for email (via password recovery) and password manager (via its function), but not for much else. E.g. while access to online banking is a catastrophe in its own right, it doesn't unlock many other accounts.
- normloman 11y agoNo, the point is, people without a password manager tend to use the same password for every account. So you steal the bank password, and it opens your email, facebook, and everything else. Hundreds of failure points. With a password manager, there is just one.
- rphlx 11y agoHuman nature being what it is, a large fraction of password-manager users probably also reuse passwords, or nearly reuse them, which is nearly as bad. With the password manager being there for cases where some BOFH admin required two relatively-prime numbers, plus three non-adjacent capital letters, plus at least one special character that's not a star, plus a final character that's not a lower case letter, plus uniqueness with respect to your previous 100 passwords, plus a length of at least 12 characters, plus a change every 14 days.
- lips 11y agoAssuming that one stores top-tier passwords (banking, primary email) in the password manager. Which is to say, yeah, 99.9% of users.
- gpvos 11y agoI've decided to start doing that (banking at least, not yet primary email), since remembering many high-security passwords is hard, and my bank has 2FA anyway. A keylogger could easily get at all of my passwords anyway, so that doesn't make the threat any worse.
- iaskwhy 11y agoWhich would be fine it more banks used a two tier approach to bank operations. Checking the balance? Username and password should suffice. Making a transaction? SMS token or matrix card or RSA key, all seem fine.
- ddmf 11y agoRoyal Bank of Scotland and First Direct use a 2FA device that is authenticated first with your bank card pin (3FA?)
- mdpye 11y agoAll the devices are the same (across customers and banks), so your card is the second factor, the device is just a reader for it.
- mdpopescu 11y agoOne of my banks (BCR Romania) requires a login with a token for initial access (just seeing stuff, or transfers between one's own accounts) and another token OTP, based on the amount and the last four digits of the destination account, for transfers to someone else.
- dwild 11y agoMy email account is safe, with 2FA it's doubtful you could access it. My phone in the other hand, is often easily accessible, his password can potentially be broken by looking at grease on it or simply waiting that I unlock it once (which I do really often) to memorize it.