5 ms·
The truth is the password is just another failed security concept- because those that work, cant be remembered by the users. So ones security researches terrib
by Pica_soO 8y ago
The truth is the password is just another failed security concept- because those that work, cant be remembered by the users.
So ones security researches terrible, is a neurologists reasonable. The actually embarrassing part is that after years of research- we still do not have a alternative.
- peteretep 8y ago> because those that work, cant be remembered by the users Remind me what's wrong with "correct horse battery staple" again?
- imajes 8y agohttps://api.pwnedpasswords.com/pwnedpassword/correct%20horse%20battery%20staple https://api.pwnedpasswords.com/pwnedpassword/correct%20horse... == 2.
- Dylan16807 8y agoyou know what they mean
- desas 8y agoRemembering a unique one for every site is hard.
- majewsky 8y agoAgain, password managers. You can have a "correct horse battery staple"-type password for that.
- packet_nerd 8y agoPassword managers are a band-aid on a fundamentally flawed technology. They are what we have now, so (if your tech savvy) that's what you're using. But it's an absolute shame that this is where we're at. I'm optimistic about the FIDO standard as a password replacement. Exciting things happening in that space recently!
- hoorayimhelping 8y agoit's hard for tech people who care about this, it's nigh impossible for laymen. it doesn't scale well.
- z3t4 8y agothrow in a bunch of random letters too!
- iliis 8y agoHow about a password manager? Or even better: Some kind of hardware token and a good standard that goes with it?
- raverbashing 8y agoPeople should use password managers, but it's a crutch.
- iliis 8y agoIf it is well integrated with your browser it's quite ok. Maybe not as convenient as using the same simple password everywhere but certainly a lot better than having to remember a lot of different passwords ;)
- samb1729 8y agoI personally prefer _not_ integrating my password manager with my browser, even though the option is available. Instead my password manager performs manually-activated autotyping which, while less convenient, does at least 'feel' like it's more secure. I trust my OS to isolate applications from eachother more than I trust my browser to isolate extensions from the page they run on. LastPass in particular have had their browser extension exploited[0]. [0]: https://blog.lastpass.com/2017/03/security-update-for-the-lastpass-extension.html/ https://blog.lastpass.com/2017/03/security-update-for-the-la...
- saimiam 8y agoI do this but I'd love to have someone tell me why this is a terrible idea (apart from the obvious one of using a 3rd party sha256 calculator) 1. Have a very short prefix and a suffix I can expect to remember 2. Password for every website gets generated like this <prefix> + website name + <suffix> 3. Generate SHA256 hash of #2 4. Use #3 as password for the site. 5. Save password to password manager Pros - 1. losing a password on one site doesn't compromise the pattern on others because cracking sha256 is still not possible (afaik) 2. relatively easy rules to create new password 3. If I HAVE to login on a computer without my password manager (e.g., public workstation), I can regenerate my password on the fly. Cons - 1. I use an external sha-256 calculator 2. Some sites enforce password length and arbitrary case/symbols rules. Have to manipulate generated password by hand
- Freak_NL 8y agoWe do have alternatives — global open cross-platform standards such as hard tokens based on the FIDO U2F and WebAuthN standards even. We're just not at the point where both users and services are willing to use these technologies.