4 ms·
This seems to be mostly about "having to remember too many passwords": > “Years ago, you had one password to keep up with at work,” she said. “Now people are b
by mtgx 10y ago
This seems to be mostly about "having to remember too many passwords":
> “Years ago, you had one password to keep up with at work,” she said. “Now people are being asked to remember 25 or 30. We haven’t really thought about cybersecurity expanding and what it has done to people.”
So why not switch to using password managers and hardware tokens then?
- stevarino 10y agoSwitching to a password manager has increased my security more than any other decision I've made, not to mention the convenience of having a secure place to store them. I recommend them to everyone I can but still people are afraid.
- abhorrence 10y agoMost people I've talked to who aren't "into computers" think they're too complicated, and don't really understand how they work. Plus they don't feel they know enough to assess whether or not they're a good idea.
- marcosdumay 10y agoThe last one is easy. You just tell them it's a very good idea. And while you are at it, tell them to use a long passphrase as a master password, ignoring upper case, numbers and special characters.
- abhorrence 10y agoYou would think it should be easy, but I've found that people have worked themselves up into a frenzy about how not-understanding of computers they are to the point where they won't even try to understand. :/
- geofft 10y agoBecause between years ago and now, security experts convinced us that you should never write down passwords or store them anywhere.
- AdmiralAsshat 10y agoParadoxically, they tell us never to write down passwords, yet they also want us to continually come up with new "secure" passwords that must: - Be rotated every 90 days - Can never be re-used - Be greater than 8 characters - Be less than 15 characters - Contain at least one letter - Contain at least one number - Contain at least one special character - Cannot contain the same character more than three times in a row - Cannot contain any piece of the username anywhere in the password - Must have a gematria value that is divisible by 12. - Cannot contain an even number of consonants or vowels in months of Saturn ascending
- hx87 10y agoYeah, at that point they might as well include a random password generator script that satisfies the conditions.
- darryl42 10y ago- Cannot contain the special character you normally use so that you can remember what password you used. :( - Have paste disabled so you need to type it. - Disable the password manager in your browser.
- nathancahill 10y agoThis is what keeps me up at night.
- deleted 10y ago[deleted]
- clarry 10y agoPassword managers are just another tradeoff of insecure vs inconvenient. All credentials under one master password? Single point of failure. You could use more passwords, but we are heading back to square one then. Next you have to decide where to make your passwords accessible for yourself. Do you also want them on the phone? Because if you don't, it can get kinda inconvenient. On the other hand, I'm quite positive my phone has more exploitable security issues than my laptop. Same for all other devices you might use. What about devices that are shared by other people? You lock yourself out of the things for which you've opted to use the password manager, or you expose it to the security issues on the said devices. I'd rather just have less stupid passwords to begin with. Why do most stores require an account for me to place an order? Not for my security. Forums, boards, other places.. anonymous posting without accounts works just fine, and there are ways to create a persistent identity for those who want it, without requiring it from everybody. Yet most "social" sites require accounts. Mostly not for my security.
- startling 10y agoPassword managers don't have a single point of failure: an attacker needs both your password and the state of the password manager.
- EvilTerran 10y agoI'd rather just have less stupid passwords to begin with. Why do most stores require an account for me to place an order? Not for my security. [...] most "social" sites require accounts. Mostly not for my security. True, that. It seems many sites insist on user accounts more for their benefit than yours - they want your email address so they can nag you towards their "funnels" for further profit opportunities, along with whatever personal and/or demographic information they can scrounge for their analytics, etc. They require you to make an account, not for your security, but merely as a premise to part you with your juicy monetisable data.
- user_bin_nice 10y agoCreate different personas for each site. This includes different usernames/emails. A password manager helps to manage this type of compartmentalization.
- pnathan 10y agoI tack a 2fa on all systems that are important to me. At home I have a gpg-encrypted file that's my password manager. I don't particularly trust third party password managers with my roots of trust. :-)