3 ms·
In 2005, password managers weren't very popular if there were any. Certainly the good ones didn't even exist[1]. I personally think that jotting down passwords
by devy 10y ago
In 2005, password managers weren't very popular if there were any. Certainly the good ones didn't even exist[1].
I personally think that jotting down passwords physically is worse than saving passwords in a good password manager. Now, there are a few good ones, like 1Password[2].
So no, I disagree with this security guru's advice with the exception of 2FA recovery codes.
[1] https://en.wikipedia.org/wiki/List_of_password_managers https://en.wikipedia.org/wiki/List_of_password_managers
[2] https://en.wikipedia.org/wiki/1Password https://en.wikipedia.org/wiki/1Password
- mikestew 10y agoMy wife still needs to get in in the event of my demise. That's why the 1Password master password and the creds to my main machine are taped to the inside of the gun safe. If someone gets into that, we've got bigger security issues.
- devy 10y agoI took Edward Snowden's advice of using long phrase/sentences as the super security password, no crazy signs / punctuation marks required ;)
- IncRnd 10y agoSnowden is correct on this. The super security password should have at least as much entropy as what is being protected.
- binthere 10y agoThe thing is: If you password is exposed once in one site, the rest of your passwords could be guessed eventually. Unless if you take some additional steps to make it really hard for anyone or any software to guess your password. See other comments on this thread.
- wil421 10y agoHow is it worse? Storing them on a piece of paper in my safe or hidden in my home is a lot less risky. Can malware or a MITM attack compromise connecting to a password manager? It seems like anyone anywhere could gain access to the password managers severs(exploit) or my computer (malware). For paper password, someone would need to know my address and then break into my house. I personally just use memory.
- Nullabillity 10y agoGood password managers (KeePass) run locally and have no remote server to connect to. Mediocre password managers still store passwords encrypted. If you get infected by malware then it could just grab the password as you type it anyway; if anything then using a password manager is slightly more secure, since browser integration goes over an authenticated connection that is harder for non-root applications to intercept. If you were good at securing physical objects then you could just lock down the computer instead, and stop bothering with passwords.
- rbritton 10y agoA password manager is also going to be more accurate at protecting from something like this: https://en.wikipedia.org/wiki/IDN_homograph_attack https://en.wikipedia.org/wiki/IDN_homograph_attack