5 ms·

Password reuse is still a huge problem. Even my friends who are somewhat savvy (not professionally in tech) don't know what a password manager is or use one.

Osiris 10y ago
There have been lots of attempts to fix this problem. The latest one is the W3C Web Authentication draft spec. I hope we get to the point where authentication doesn't rely on the human memory at all.
rhcom2 10y ago
The response I get from even savvy tech people is like I just told them they really should be flossing more.
- astrodust 10y ago
  It's like when a dentist tells you that it's ideal to brush three times a day after meals, plus once more in the evening.
  - mirimir 10y ago
    Sure, but then an honest dentist told me that what's most important is flossing and brushing before bed. So what's the analogous tl;dr for account management? Don't use passwords like "mysecretpassword", and don't reuse them?
    - literallycancer 10y ago
      "Use a password manager" is the tl;dr already.
      - mirimir 10y ago
        Sure, but http://www.darknet.org.uk/2017/03/lastpass-chrome-extension-leaking-passwords/ http://www.darknet.org.uk/2017/03/lastpass-chrome-extension-... So maybe, "use a local password manager"?
        deleted 10y ago
        [deleted]
    - tonyedgecombe 10y ago
      Then we find out flossing isn't much benefit: https://www.theguardian.com/us-news/2016/aug/02/dental-floss-proof-works-guidelines-dropped https://www.theguardian.com/us-news/2016/aug/02/dental-floss...
      - mirimir 10y ago
        Well, when you're older, with iffy teeth, flossing removes trapped food that will cause inflammation and pain, the next day. That's personal experience.
        jdeibele 10y ago
        Sadly I have to upvote this based on personal experience. Was reading this thread right after the thread on John Goodenough. There are different things that happen as one gets older that one wishes didn't. Still, it beats the alternative.
  - shalmanese 10y ago
    Except you really shouldn't brush right after a meal: http://www.hamiltonsmiles.com/blog/2016/04/dont-brush-after-every-meal http://www.hamiltonsmiles.com/blog/2016/04/dont-brush-after-...
    - TheSpiceIsLife 10y ago
      First, rinse with or drink clear water. Then chew some sugarless gum. Both of these practices will produce saliva, restore a healthy pH level in your mouth, and coat your teeth with nourishing minerals. Out of all the sugarless gums available, the best of the best are those that list xylitol as the first ingredient. Another option is to consume cheese, milk, or another non-acidic food or drink to conclude your meal. After you have given your mouth time to return to a healthy pH, feel free to brush your teeth. Well good, that's how I've been doing it.
- mikeash 10y ago
  Which is weird, because using a password manager makes things easier. It's not extra effort to be secure.
  - chongli 10y ago
    using a password manager makes things easier Until you lose the database, then things become really difficult.
    - EduardoBautista 10y ago
      I find this to be really difficult to do with 1Password
    - closeparen 10y ago
      I can access my phone and email without the password manager. That's enough to recover the rest.
    - mikeash 10y ago
      Data loss sucks no matter what it is. That's why God gave us backups.
draw_down 10y ago
Sure, I don't think this is arguing that password reuse is not a problem.
zitterbewegung 10y ago
After I searched for my credentials on haveibeenpwned I have started to use the suggested password feature for my important sites. I should really move all of them to this instead of my memorized password.
raverbashing 10y ago
We should not have had to use password managers if the sites asking for passwords had not been developed by doofuses but then again...
JohnJamesRambo 10y ago
Several password managers have been hacked though...
- drampelt 10y ago
  The same author has an article on this subject as well: https://www.troyhunt.com/password-managers-dont-have-to-be-perfect-they-just-have-to-be-better-than-not-having-one/ https://www.troyhunt.com/password-managers-dont-have-to-be-p...
  - JohnJamesRambo 10y ago
    He isn't giving me any hard data or proof that password managers are superior other than "they are because I say so." I'd like to see statistics. It seems intuitive but often things that seem intuitive are not so. I can see many ways a central repository of ALL my passwords could be more disastrous than someone hacking my login at one site.

Osiris 10y ago

There have been lots of attempts to fix this problem. The latest one is the W3C Web Authentication draft spec. I hope we get to the point where authentication doesn't rely on the human memory at all.

rhcom2 10y ago

The response I get from even savvy tech people is like I just told them they really should be flossing more.

astrodust 10y ago
It's like when a dentist tells you that it's ideal to brush three times a day after meals, plus once more in the evening.
- mirimir 10y ago
  Sure, but then an honest dentist told me that what's most important is flossing and brushing before bed. So what's the analogous tl;dr for account management? Don't use passwords like "mysecretpassword", and don't reuse them?
  - literallycancer 10y ago
    "Use a password manager" is the tl;dr already.
    - mirimir 10y ago
      Sure, but http://www.darknet.org.uk/2017/03/lastpass-chrome-extension-leaking-passwords/ http://www.darknet.org.uk/2017/03/lastpass-chrome-extension-... So maybe, "use a local password manager"?
      - deleted 10y ago
        [deleted]
  - tonyedgecombe 10y ago
    Then we find out flossing isn't much benefit: https://www.theguardian.com/us-news/2016/aug/02/dental-floss-proof-works-guidelines-dropped https://www.theguardian.com/us-news/2016/aug/02/dental-floss...
    - mirimir 10y ago
      Well, when you're older, with iffy teeth, flossing removes trapped food that will cause inflammation and pain, the next day. That's personal experience.
      - jdeibele 10y ago
        Sadly I have to upvote this based on personal experience. Was reading this thread right after the thread on John Goodenough. There are different things that happen as one gets older that one wishes didn't. Still, it beats the alternative.
- shalmanese 10y ago
  Except you really shouldn't brush right after a meal: http://www.hamiltonsmiles.com/blog/2016/04/dont-brush-after-every-meal http://www.hamiltonsmiles.com/blog/2016/04/dont-brush-after-...
  - TheSpiceIsLife 10y ago
    First, rinse with or drink clear water. Then chew some sugarless gum. Both of these practices will produce saliva, restore a healthy pH level in your mouth, and coat your teeth with nourishing minerals. Out of all the sugarless gums available, the best of the best are those that list xylitol as the first ingredient. Another option is to consume cheese, milk, or another non-acidic food or drink to conclude your meal. After you have given your mouth time to return to a healthy pH, feel free to brush your teeth. Well good, that's how I've been doing it.
mikeash 10y ago
Which is weird, because using a password manager makes things easier. It's not extra effort to be secure.
- chongli 10y ago
  using a password manager makes things easier Until you lose the database, then things become really difficult.
  - EduardoBautista 10y ago
    I find this to be really difficult to do with 1Password
  - closeparen 10y ago
    I can access my phone and email without the password manager. That's enough to recover the rest.
  - mikeash 10y ago
    Data loss sucks no matter what it is. That's why God gave us backups.

draw_down 10y ago

Sure, I don't think this is arguing that password reuse is not a problem.

zitterbewegung 10y ago

After I searched for my credentials on haveibeenpwned I have started to use the suggested password feature for my important sites. I should really move all of them to this instead of my memorized password.

raverbashing 10y ago

We should not have had to use password managers if the sites asking for passwords had not been developed by doofuses but then again...

JohnJamesRambo 10y ago

Several password managers have been hacked though...

drampelt 10y ago
The same author has an article on this subject as well: https://www.troyhunt.com/password-managers-dont-have-to-be-perfect-they-just-have-to-be-better-than-not-having-one/ https://www.troyhunt.com/password-managers-dont-have-to-be-p...
- JohnJamesRambo 10y ago
  He isn't giving me any hard data or proof that password managers are superior other than "they are because I say so." I'd like to see statistics. It seems intuitive but often things that seem intuitive are not so. I can see many ways a central repository of ALL my passwords could be more disastrous than someone hacking my login at one site.