3 ms·
This post makes a lot of assumptions. This is a hard one because I agree with most of OP's points but, teaching people to use a password manager is not easy,an
by badrabbit 8y ago
This post makes a lot of assumptions.
This is a hard one because I agree with most of OP's points but, teaching people to use a password manager is not easy,and even then , password managers on mobile devices make for a bad experience. Like it or not, people will need to memorize passwords and they will reuse password across applications and site.That's something security engineers must accept as a reality.
The solution is:
1) Don't use password authentication on your site(at all)
2) Use 2FA even if you must use passwords.
No one will argue that a passphrase is better than a randomly generated password if you use a password manager. But if you must remember the passwors then a passphrase is better.