5 ms·

Password managers really do need to be forced on people, not only because of unsafe password issues but because of username issues listed in the OP as well.

mehrdadn 9y ago
At the risk of going a bit on a tangent, what password manager would you recommend for my grandma?
- greglindahl 9y ago
  Is your grandma Grace Hopper? Or someone more stereotypical?
  - mehrdadn 9y ago
    Not quite Grace Hopper, just Hedy Lamarr. :-P (Wouldn't the question only make much sense in just one of those cases...? Not sure if I'm missing anything.)
    - lwf 9y ago
      There's a case made that statements like "so my grandma can use it" is (unintentionally) implicitly agist and sexist -- Grace Hopper worked in computing until her death at age 85.
- mozumder 9y ago
  Get her an iPhone or iPad, and have her use the built-in password manager.
  - mehrdadn 9y ago
    Anything using cheaper/more common hardware? so the user doesn't have to buy new hardware and switch ecosystems just for the sake of being able to manage passwords? (i.e. anything PC/Android?)
    - mozumder 9y ago
      Is your grandma REALLY tied to some ecosystem? Is she a Visual Studio Code developer? Does she need to manage Docker containers? Security does require new hardware because iOS is leaps-and-bounds better than any other system. There is no other option. Nothing else comes close.
      - mehrdadn 9y ago
        I mean, if you agree that the only option for mass adoption of password managers is to get people to shell out $$$+ for new hardware and switch ecosystems, I rest my case.
        mozumder 9y ago
        Not sure what your case is? Were you expecting security in broken systems like Android? Instead of forcing security onto a broken system, just avoid that system? The fist step of security: stop using Android. And you haven't explained why your grandma is tied to an ecosystem. I'm honestly asking if she's a developer or not? What is her use case? Why does she need to be on a specific platform?
        Macha 9y ago
        As developers we might be used to paying 100s of euros (or signing up to a contract to effectively do the same over time) on a phone, but the point is $grandma may not be willing to spend even 20% of iPhone budget (and definitely not replacing it by the time OS updates end)
      - derrikcurran 9y ago
        You don't need to be a developer to be tied to an ecosystem. Maybe she wouldn't want to lose her Candy Crush purchases?
- Nullabillity 9y ago
  KeePassXC on desktop, KeepShare on mobile.
  - mehrdadn 9y ago
    KeePassXC doesn't support synchronization though?
    - distances 9y ago
      What kind of synchronization? Keeping the database in Nextcloud/Dropbox should work fine.
      - mehrdadn 9y ago
        Interesting... that actually works fine? What happens if you make an edit to your password database on your phone, and then make another independent edit on your PC, and then they both get a chance to synchronize? Do they both persist, or do you lose one?
        Nullabillity 9y ago
        I use Dropbox. I haven't actually tried that case since I rarely change my database from my phone. That said, I have had conflicts between two computers, but KeePassXC's built-in merge tool have fixed those nicely.
        distances 9y ago
        I can't honestly remember, it either lets you choose which file to keep or creates a copy. Might be that Dropbox and Nextcloud even behave differently. If I edit the file on mobile, I make a point of triggering the synchronization right after to avoid the problem. If you're on Android, Keepass2Android [1] is an excellent app that implements the input with a special keyboard. This avoids risking your password via the clipboard. It even comes with a no-network-permission version! [1] https://play.google.com/store/apps/details?id=keepass2android.keepass2android_nonet https://play.google.com/store/apps/details?id=keepass2androi...
- blowski 9y ago
  Use a paper notepad. Generate passwords by opening a dictionary at random for 3 words, with a random number at the end. It’s not as good as, say, 1Password but it’s more likely to get used. Combine it with the browser or OS level password manager. It’s good enough for grandma, definitely better than “kitten4” that she’s currently using everywhere. On a tangent, stereotyping this as “grandma” is a bit unfair. Most of my colleagues are college educated males in their 20s, some of them developers. And their passwords are rubbish, with no password manager, and no 2fa.
  - mehrdadn 9y ago
    Aside from how painful that sounds, paper notepads can easily get lost. And if she's out and wants to check stuff on her phone (or trying to check her bank account at my aunt's home, or whatever), is she supposed to carry it all around and risk getting it stolen? If that's the implication, I'd rather she just have kitten4 at that point. (And re: the grandma thing: it's nothing specific to grandmas, it's because the moment you suggest your audience is "college educated developers in their twenties" as in your case, people throw the notion of UI/UX out the window and recommend you suggest they compile their own kernel first. It seems you just can't win.)
    - blowski 9y ago
      We are obviously talking about a different stereotype. My “grandma” already keeps various notepads - recipes, appointments, address books. And she never has an urgent need to check her bank account while at Auntie Rita’s. As such, this fits her needs and workflow.
      - aninhumer 9y ago
        Yeah. In fact most likely, she's already written down "kitten4" in a notepad somewhere, because she doesn't trust herself to remember. So asking her to use a slightly longer password is not a massive change.
    - jwl 9y ago
      If we make a crude risk assessment, it is way more likely that her account will be randomly hacked by a botnet if she has "kitten4" as a password than someone actively stealing her purse to get her passwords. And if the notebook with passwords was stolen/lost, she would at least know it and be able to take preventive measures. For most people, writing (good and unique) passwords down in a notepad is a way more secure system than having the same bad password for every account.
- hx87 9y ago
  Dashlane. Synchronization included, easy to use, works both offline and online.

mehrdadn 9y ago

At the risk of going a bit on a tangent, what password manager would you recommend for my grandma?

greglindahl 9y ago
Is your grandma Grace Hopper? Or someone more stereotypical?
- mehrdadn 9y ago
  Not quite Grace Hopper, just Hedy Lamarr. :-P (Wouldn't the question only make much sense in just one of those cases...? Not sure if I'm missing anything.)
  - lwf 9y ago
    There's a case made that statements like "so my grandma can use it" is (unintentionally) implicitly agist and sexist -- Grace Hopper worked in computing until her death at age 85.
mozumder 9y ago
Get her an iPhone or iPad, and have her use the built-in password manager.
- mehrdadn 9y ago
  Anything using cheaper/more common hardware? so the user doesn't have to buy new hardware and switch ecosystems just for the sake of being able to manage passwords? (i.e. anything PC/Android?)
  - mozumder 9y ago
    Is your grandma REALLY tied to some ecosystem? Is she a Visual Studio Code developer? Does she need to manage Docker containers? Security does require new hardware because iOS is leaps-and-bounds better than any other system. There is no other option. Nothing else comes close.
    - mehrdadn 9y ago
      I mean, if you agree that the only option for mass adoption of password managers is to get people to shell out $$$+ for new hardware and switch ecosystems, I rest my case.
      - mozumder 9y ago
        Not sure what your case is? Were you expecting security in broken systems like Android? Instead of forcing security onto a broken system, just avoid that system? The fist step of security: stop using Android. And you haven't explained why your grandma is tied to an ecosystem. I'm honestly asking if she's a developer or not? What is her use case? Why does she need to be on a specific platform?
        Macha 9y ago
        As developers we might be used to paying 100s of euros (or signing up to a contract to effectively do the same over time) on a phone, but the point is $grandma may not be willing to spend even 20% of iPhone budget (and definitely not replacing it by the time OS updates end)
    - derrikcurran 9y ago
      You don't need to be a developer to be tied to an ecosystem. Maybe she wouldn't want to lose her Candy Crush purchases?
Nullabillity 9y ago
KeePassXC on desktop, KeepShare on mobile.
- mehrdadn 9y ago
  KeePassXC doesn't support synchronization though?
  - distances 9y ago
    What kind of synchronization? Keeping the database in Nextcloud/Dropbox should work fine.
    - mehrdadn 9y ago
      Interesting... that actually works fine? What happens if you make an edit to your password database on your phone, and then make another independent edit on your PC, and then they both get a chance to synchronize? Do they both persist, or do you lose one?
      - Nullabillity 9y ago
        I use Dropbox. I haven't actually tried that case since I rarely change my database from my phone. That said, I have had conflicts between two computers, but KeePassXC's built-in merge tool have fixed those nicely.
      - distances 9y ago
        I can't honestly remember, it either lets you choose which file to keep or creates a copy. Might be that Dropbox and Nextcloud even behave differently. If I edit the file on mobile, I make a point of triggering the synchronization right after to avoid the problem. If you're on Android, Keepass2Android [1] is an excellent app that implements the input with a special keyboard. This avoids risking your password via the clipboard. It even comes with a no-network-permission version! [1] https://play.google.com/store/apps/details?id=keepass2android.keepass2android_nonet https://play.google.com/store/apps/details?id=keepass2androi...
blowski 9y ago
Use a paper notepad. Generate passwords by opening a dictionary at random for 3 words, with a random number at the end. It’s not as good as, say, 1Password but it’s more likely to get used. Combine it with the browser or OS level password manager. It’s good enough for grandma, definitely better than “kitten4” that she’s currently using everywhere. On a tangent, stereotyping this as “grandma” is a bit unfair. Most of my colleagues are college educated males in their 20s, some of them developers. And their passwords are rubbish, with no password manager, and no 2fa.
- mehrdadn 9y ago
  Aside from how painful that sounds, paper notepads can easily get lost. And if she's out and wants to check stuff on her phone (or trying to check her bank account at my aunt's home, or whatever), is she supposed to carry it all around and risk getting it stolen? If that's the implication, I'd rather she just have kitten4 at that point. (And re: the grandma thing: it's nothing specific to grandmas, it's because the moment you suggest your audience is "college educated developers in their twenties" as in your case, people throw the notion of UI/UX out the window and recommend you suggest they compile their own kernel first. It seems you just can't win.)
  - blowski 9y ago
    We are obviously talking about a different stereotype. My “grandma” already keeps various notepads - recipes, appointments, address books. And she never has an urgent need to check her bank account while at Auntie Rita’s. As such, this fits her needs and workflow.
    - aninhumer 9y ago
      Yeah. In fact most likely, she's already written down "kitten4" in a notepad somewhere, because she doesn't trust herself to remember. So asking her to use a slightly longer password is not a massive change.
  - jwl 9y ago
    If we make a crude risk assessment, it is way more likely that her account will be randomly hacked by a botnet if she has "kitten4" as a password than someone actively stealing her purse to get her passwords. And if the notebook with passwords was stolen/lost, she would at least know it and be able to take preventive measures. For most people, writing (good and unique) passwords down in a notepad is a way more secure system than having the same bad password for every account.
hx87 9y ago
Dashlane. Synchronization included, easy to use, works both offline and online.