8 ms·

It is not just that everyone knows how passwords work. It is also that you can always enter a password. What if I don't have my phone to scan a qr-code? What i

It is not just that everyone knows how passwords work. It is also that you can always enter a password. What if I don't have my phone to scan a qr-code? What if I want to use a minimalistic browser that doesn't implement a key pair store and I don't want to or can't set up one external? What if my minimal browser is text only? What if I'm on another device and don't have my stuff on there? I will pretty much always be able to enter a string of characters. To quote the unix phillosphy: Text is the universal interface.

bhaak 8y ago
I see where you are coming from but sometimes you have to enforce some things. If you don't have 2FA, you can't login into this site is a completely rational consequence if for example this site is handling financial assets of yours. But it's possible that in the future we will put the bar higher. Then these arguments might be considered as silly as "with HTTPS I can no longer telnet into a web site and issue HTTP commands by hand!" (and don't tell me people didn't do that, I did it myself).
- acdha 8y ago
  There’s also room for nuance even with financial sites: e.g. do MFA for everything which causes money to change hands but don’t require it every time someone checks their balance or confirms that their rent check went through, especially from a frequently-used client. Similarly, if you’re not a financial site question whether you’re doing anything of value. The Netflix example is great: a huge password really doesn’t matter unless the site allows you to see stored credit card information since the worst thing someone can do is load your viewing history up with high ratings for Iron Fist. Continuing to cargo cult DoD policies from the 1970s has caused more problems than it’s stopped.
  - AstralStorm 8y ago
    Indeed, the best policy is to not store any data. Even easier to comply with GDPR this way. No account is best account. This requires that the site supports automatic completion and pasting. Quite a few sites explicitly prevent it for stupid reasons like assuming user browser is compromised. (If it is, you shouldn't be using the webpage for authentication.)
    - acdha 8y ago
      I really value the GDPR for getting companies to see stored data as a potential risk rather than just something which can potentially be sold later.
  - beatgammit 8y ago
    They could also: - increase your subscription and watch using your account for free - send DVDs to their house and sell them - use your same email/password combo on other sites If you use 2FA for most things, it's much harder exploit anything. However, you need to use good 2FA, not that SMS crap.
    - acdha 8y ago
      Everything you mentioned was covered in my original comment: > - increase your subscriptio This should force a confirmation and notifications as I noted. Simply checking the credit card CVV is way more useful than traditional MFA. > and watch using your account for free Not your problem and Netflix must monitor that to catch friends and family sharing anyway. > - send DVDs to their house and sell them Also a financial change which should trigger checks. Again, CVV does the job perfectly fine. > use your same email/password combo on other sites This is only true if they utterly botch the design by storing passwords insecurely and displaying them to the user. If either of those are true, it’s virtually certain that they’ve made equally bad mistakes elsewhere which MFA won’t help with.
- cyborgx7 8y ago
  I would never claim there is no legitimacy to enforcing 2FA. At my last job we ran into a situation like that. I always lacked things other people and services took for granted for financial and political reasons (like a smartphone). When we were required to use 2FA for some services at work it caused some friction for me. We found a workable solution, but it was less than ideal. They were right to turn on 2FA but it does come at a cost, and that cost isn't always worth it. >But it's possible that in the future we will put the bar higher. Then these arguments might be considered as silly as "with HTTPS I can no longer telnet into a web site and issue HTTP commands by hand!" (and don't tell me people didn't do that, I did it myself). I'm actually going to make the opposite counter-argument. I do think https is a great achievement but I also think we lost something with the additional complexity introduced in, what used to be, a fairly simple protocol with wide adoption. I don't think those were silly arguments to have had.
  - beatgammit 8y ago
    For your telnet example, you can still use ncat, opens, or gnutls-cli to enter HTTP commands directly over a TLS transport. Yes it's more complicated, but it's still doable.
    - cyborgx7 8y ago
      Of course I feel a lot better using ssh than using telnet. I just don't want people to discount that this added complexity is the price we pay for the security.
acdha 8y ago
Another aspect to this is that it’s single channel: no problem if your phone is out of data or at 1% battery, you need USB-A but have USB-C, etc. Nobody needs to regularly read a code to someone over the phone but the people who have are probably going to remember that when getting pitched on any new system. This is terrible from the perspective of phishing but we really need to avoid that causing us to ignore the usability hassles to everything else. I’m happy to see that conversation get more nuanced, too, rather than just being game-theoretical about perfect security: acknowledging the usability and security costs of password complexity requirements or expiration, having intermediate checks for more sensitive operations so you’re not training users to hammer their password out hundreds of times a day, etc.
simias 8y ago
I agree that it's a more salient point IMO. Smartphone based authenticator are not exactly difficult to understand, at least from a user's perspective. You enter your username, you get a prompt on your password, you're done. Yubikeys are not difficult either. You enter your username, you focus the password field and you press the button. There, you're done. If anything it's easier and more convenient than a password. Passwords are just the lowest common denominator. Everybody can memorize a character string, not everybody has a smartphone or yubikey with them at all times.
- AstralStorm 8y ago
  The second way is to use one time pads in addition to passwords. Who needs a smartphone when you can use a piece of paper. Mind you this can be copied so has a similar vulnerability to passwords. But since it can be generated you can think of it as a salted password when combined with a classic one. And then we use the final way of authentication, hard to forge personal documents, government issued... often in poor ways. Computer systems cannot be truly fully trusted. Final security always depends on the human operators and equivalent human impersonators. A skilled social engineer can even convince your friends the account is dead. They can call the delivery company or even initiate the procedure to reissue documents or destroy keys. They can phish and scam you which is even easier.
- Sean1708 8y ago
  > You enter your username, you focus the password field and you press the button. How much set up does it take to get to that point though? Usability at point of use is great but setting something up is usually far more difficult than actually using it.
  - beatgammit 8y ago
    They provide software that you install to configure your device. I haven't used it personally (my Neo 5 is being delivered), but they've done a pretty good job of making it easy. The biggest problems are: - limited selection of sites that support U2F - U2F is off by default in Firefox (it's a little buggy apparently) - somewhat expensive ($45 for Yubikey Neo) Those are getting better, and I think the Yubikey can be used OOTB (you just enable it on an existing login to prove you own it). I'll be regenerating keys, but most users probably won't bother.
microcolonel 8y ago
Also, I do not own a smartphone.
lukebennett 8y ago
Medium is frustratingly guilty here. Your login choices are limited to sharing data with Google/Facebook/Twitter or clicking a magic link in an email. If you don't like to share your data with third parties then you are basically restricted to logging in on devices that have access to your email. Which means you're stuffed when that doesn't apply. Security at the expense of usability is fine when it's warranted. All too often it's not.
- SilasX 8y ago
  What about a throwaway email? Does that leak device data? (This whole thing reminds me of “Your post advocates a ... approach to spam. Your idea will not work. Here is why...” And maybe warrants a similar parody.)
  - lukebennett 8y ago
    It's not so much the choice of email address (throwaway or not) but the fact that you physically can't log in on a machine where you can't/don't want to access your email. You can't access the link and it's too long and cumbersome to type out manually. So your only choice is to access your (personal) email on a device where you may not want/be allowed to.
    - munk-a 8y ago
      I don't find that so objectionable, to log into their site you need to enter some credentials, _usually_ that checking is being offloaded from medium onto a third party you may trust more. In the case that you really need to access it where you don't wish to log into your primary email you will still need to login to something, their approach allows you to choose what sort of login security you'd like (maybe you want 2FA via google, maybe you want a more security lax service) I think password managers are great but the service I see them providing that has the most benefit is to reduce the number of passwords the user needs to actively remember. The single sign on approach has it's weaknesses but the idea itself is pretty sound, you should legitimately trust facebook or google or whoever to know more about secure authentication than some random site... the fact that this service comes with a privacy leak and implies greater online presence tracking is terrible, but the core idea is sound. It'd just be nice to have a neutral party doing it.
snarf21 8y ago
It is generally always a trade-off between security and convenience. You can demand that a site allow passwords but you also aren't memorizing a 24 character nonsense password for each site login. The holy grail is can you bend the line and have something that is super secure and mostly convenient.
- meuk 8y ago
  I currently work in an environment where I don't have access to a password manager, yet I am expected to have unique passwords for each service, and rotate passwords every month, and am not allowed to store passwords somewhere. Of course, this method requires you to remember more passwords than practically possible. If all accounts would have sane restrictions on the password it would become trivial to have something both secure and convenient. I have been looking for a system that allows me to: 1. Does not require me to remember an absurd amount of information. 2. Allows me to login to services, even from other devices. 3. Has a unique password for each service (so that it is not disastrous if one password leaks). We could have one master password, use site and username (and maybe a counter, to make it easy to rotate passwords) as salt, and use a hashing or password derivation algorithm to derive a unique password for each service. This would only require you to pick and remember a strong master password.
  - jki275 8y ago
    I know that environment well, you pretty much have to come up with a hash function you can do in your head. Is it secure? Maybe you can pull it off. I think most people can't, and that's what leads to people writing down passwords.
    - ryan-c 8y ago
      Writing down passwords is usually less bad than password reuse and use of weak passwords.
      - jki275 8y ago
        Depending on the physical security posture of the location where the passwords are stored, that can be a correct statement. I wouldn't argue "usually" simply because most people aren't smart about where they're stored.
ken 8y ago
Sort of. You're selectively quoting "Write programs to handle text streams, because that is a universal interface" -- but that was from the days when "text" was basically synonymous with "ASCII". Passwords aren't streams, and in the Unicode world, they're not even (predictable) byte arrays. This isn't just hypothetical. There have been recent bugs in major systems where people with non-ASCII passwords couldn't type them. One of the major failings of QR codes for consumer use, IMHO, is that there is no fallback. With UPC, the number is printed right below the barcode, so when it doesn't scan, the clerk can just type in the digits. ASCII digits are universal. Bytes are universal. Text is ... complicated.
- cyborgx7 8y ago
  The idea of "text is the universal interface" informed the design of unix and it resulted in text streams. But if I apply it to something entirely different, authentication, I come out at passwords. And I wouldn't say that text meant ASCII. My understanding is that it meant text is the thing that could be understood and written by both people and computers.
  - ggm 8y ago
    The back story of the work some significant UNIX people did to get UTF8/Unicode into workable state in standards is amazing. Application of brilliant minds to a corner-case problem in international standards. http://doc.cat-v.org/bell_labs/utf-8_history http://doc.cat-v.org/bell_labs/utf-8_history
- jniedrauer 8y ago
  > ASCII digits are universal. Bytes are universal. Text is ... complicated. All text should be UTF-8. It really shouldn't be complicated in $current_year.
  - npongratz 8y ago
    Unicode itself gets pretty complicated: https://en.wikipedia.org/wiki/Unicode_equivalence https://en.wikipedia.org/wiki/Unicode_equivalence
krupan 8y ago
"It is also that you can always enter a password." You are correct, as long as you throw out all the other password advice that, ironically, Troy Hunt has given us about not reusing passwords, making them long or full of hard-to-memorize characters, etc. Once you use secure passwords by making them long and/or hard to memorize, unique for each website, etc., you can't just rely on your brain, fingers, and an awkward on-screen keyboard to "always enter a password." You need your password manager with you, you need privacy so nobody can shoulder surf while you agonizingly peck out your password on your touch screen keyboard (remember everyone learning Kanye's cell phone password recently?), etc. Your statement about universality is only technically true.
- codyb 8y ago
  I'm not sure it has to be so difficult. It took me about an hour to come up with a scheme for creating long, unique, and random looking passwords that are very easy to remember. Basically I have a prefix of length 7 which is two words, where some of the letters get converted to numbers, and then I use shift to make them into special characters. Then for each website I append a different word that has some meaning for me, and convert the letters to numbers. Then I add a special character at the end. A typical password might look like P!^^w)r$M19175r? Which is very easy for me to remember and type, reasonably long, and certainly not on any lists of most commonly used passwords. Ways you could improve this method would be to have different prefixes for different industries (banking, social media, etc).
  - thaumaturgy 8y ago
    Yes, there are this and myriad other schemes to accomplish the same thing. This doesn't much help the average customer service worker who struggles to give correct change if you hand them cash in an amount that's not a round number. Passwords are a thing that need to work for everyone, which means they need to work for the lowest common denominator too, which means the GP is correct to point out that password advice is contradictory: the lowest common denominator cannot both use strong, unique passwords and avoid using some other kind of technology to assist with that.
  - 8y ago
irrational 8y ago
Or, what if I don't own a phone? I do own a phone, but my wife does not because she doesn't want one.
- cyborgx7 8y ago
  I am particularly empathetic to that position, because I didn't own a phone until very recently and it caused a bunch of problems for me. It informed my perspective a lot.
codedokode 8y ago
> It is also that you can always enter a password. If you remember it. You either have to use weaker passwords (for example, same password on several sites) or you won't be able to remember them. Or you can write them down which is pretty secure, but is not it easier just to carry a hardware key instead of a notepad with passwords? Also, once I accidentaly deleted Latin keyboard layout in Linux (yes, it is easy). And having only Russian layout I was unable to enter the password to log in (and even if I could I wouln't be able to use the console). I tried to use on-screen keyboard, but in Debian it cannot input characters not present in keyboard layout.
- tim333 8y ago
  A bit of a bodge I find works is to make my passwords of the form word+site+number, say Mangohn4234 for HN. Then they are all different, pass the has it been pawned thing and its quite easy to remember Mango 4234 or similar if you use that for them all.

bhaak 8y ago

I see where you are coming from but sometimes you have to enforce some things. If you don't have 2FA, you can't login into this site is a completely rational consequence if for example this site is handling financial assets of yours. But it's possible that in the future we will put the bar higher. Then these arguments might be considered as silly as "with HTTPS I can no longer telnet into a web site and issue HTTP commands by hand!" (and don't tell me people didn't do that, I did it myself).

acdha 8y ago
There’s also room for nuance even with financial sites: e.g. do MFA for everything which causes money to change hands but don’t require it every time someone checks their balance or confirms that their rent check went through, especially from a frequently-used client. Similarly, if you’re not a financial site question whether you’re doing anything of value. The Netflix example is great: a huge password really doesn’t matter unless the site allows you to see stored credit card information since the worst thing someone can do is load your viewing history up with high ratings for Iron Fist. Continuing to cargo cult DoD policies from the 1970s has caused more problems than it’s stopped.
- AstralStorm 8y ago
  Indeed, the best policy is to not store any data. Even easier to comply with GDPR this way. No account is best account. This requires that the site supports automatic completion and pasting. Quite a few sites explicitly prevent it for stupid reasons like assuming user browser is compromised. (If it is, you shouldn't be using the webpage for authentication.)
  - acdha 8y ago
    I really value the GDPR for getting companies to see stored data as a potential risk rather than just something which can potentially be sold later.
- beatgammit 8y ago
  They could also: - increase your subscription and watch using your account for free - send DVDs to their house and sell them - use your same email/password combo on other sites If you use 2FA for most things, it's much harder exploit anything. However, you need to use good 2FA, not that SMS crap.
  - acdha 8y ago
    Everything you mentioned was covered in my original comment: > - increase your subscriptio This should force a confirmation and notifications as I noted. Simply checking the credit card CVV is way more useful than traditional MFA. > and watch using your account for free Not your problem and Netflix must monitor that to catch friends and family sharing anyway. > - send DVDs to their house and sell them Also a financial change which should trigger checks. Again, CVV does the job perfectly fine. > use your same email/password combo on other sites This is only true if they utterly botch the design by storing passwords insecurely and displaying them to the user. If either of those are true, it’s virtually certain that they’ve made equally bad mistakes elsewhere which MFA won’t help with.
cyborgx7 8y ago
I would never claim there is no legitimacy to enforcing 2FA. At my last job we ran into a situation like that. I always lacked things other people and services took for granted for financial and political reasons (like a smartphone). When we were required to use 2FA for some services at work it caused some friction for me. We found a workable solution, but it was less than ideal. They were right to turn on 2FA but it does come at a cost, and that cost isn't always worth it. >But it's possible that in the future we will put the bar higher. Then these arguments might be considered as silly as "with HTTPS I can no longer telnet into a web site and issue HTTP commands by hand!" (and don't tell me people didn't do that, I did it myself). I'm actually going to make the opposite counter-argument. I do think https is a great achievement but I also think we lost something with the additional complexity introduced in, what used to be, a fairly simple protocol with wide adoption. I don't think those were silly arguments to have had.
- beatgammit 8y ago
  For your telnet example, you can still use ncat, opens, or gnutls-cli to enter HTTP commands directly over a TLS transport. Yes it's more complicated, but it's still doable.
  - cyborgx7 8y ago
    Of course I feel a lot better using ssh than using telnet. I just don't want people to discount that this added complexity is the price we pay for the security.

acdha 8y ago

Another aspect to this is that it’s single channel: no problem if your phone is out of data or at 1% battery, you need USB-A but have USB-C, etc. Nobody needs to regularly read a code to someone over the phone but the people who have are probably going to remember that when getting pitched on any new system. This is terrible from the perspective of phishing but we really need to avoid that causing us to ignore the usability hassles to everything else. I’m happy to see that conversation get more nuanced, too, rather than just being game-theoretical about perfect security: acknowledging the usability and security costs of password complexity requirements or expiration, having intermediate checks for more sensitive operations so you’re not training users to hammer their password out hundreds of times a day, etc.

simias 8y ago

I agree that it's a more salient point IMO. Smartphone based authenticator are not exactly difficult to understand, at least from a user's perspective. You enter your username, you get a prompt on your password, you're done. Yubikeys are not difficult either. You enter your username, you focus the password field and you press the button. There, you're done. If anything it's easier and more convenient than a password. Passwords are just the lowest common denominator. Everybody can memorize a character string, not everybody has a smartphone or yubikey with them at all times.

AstralStorm 8y ago
The second way is to use one time pads in addition to passwords. Who needs a smartphone when you can use a piece of paper. Mind you this can be copied so has a similar vulnerability to passwords. But since it can be generated you can think of it as a salted password when combined with a classic one. And then we use the final way of authentication, hard to forge personal documents, government issued... often in poor ways. Computer systems cannot be truly fully trusted. Final security always depends on the human operators and equivalent human impersonators. A skilled social engineer can even convince your friends the account is dead. They can call the delivery company or even initiate the procedure to reissue documents or destroy keys. They can phish and scam you which is even easier.
Sean1708 8y ago
> You enter your username, you focus the password field and you press the button. How much set up does it take to get to that point though? Usability at point of use is great but setting something up is usually far more difficult than actually using it.
- beatgammit 8y ago
  They provide software that you install to configure your device. I haven't used it personally (my Neo 5 is being delivered), but they've done a pretty good job of making it easy. The biggest problems are: - limited selection of sites that support U2F - U2F is off by default in Firefox (it's a little buggy apparently) - somewhat expensive ($45 for Yubikey Neo) Those are getting better, and I think the Yubikey can be used OOTB (you just enable it on an existing login to prove you own it). I'll be regenerating keys, but most users probably won't bother.

microcolonel 8y ago

Also, I do not own a smartphone.

lukebennett 8y ago

Medium is frustratingly guilty here. Your login choices are limited to sharing data with Google/Facebook/Twitter or clicking a magic link in an email. If you don't like to share your data with third parties then you are basically restricted to logging in on devices that have access to your email. Which means you're stuffed when that doesn't apply. Security at the expense of usability is fine when it's warranted. All too often it's not.

SilasX 8y ago
What about a throwaway email? Does that leak device data? (This whole thing reminds me of “Your post advocates a ... approach to spam. Your idea will not work. Here is why...” And maybe warrants a similar parody.)
- lukebennett 8y ago
  It's not so much the choice of email address (throwaway or not) but the fact that you physically can't log in on a machine where you can't/don't want to access your email. You can't access the link and it's too long and cumbersome to type out manually. So your only choice is to access your (personal) email on a device where you may not want/be allowed to.
  - munk-a 8y ago
    I don't find that so objectionable, to log into their site you need to enter some credentials, _usually_ that checking is being offloaded from medium onto a third party you may trust more. In the case that you really need to access it where you don't wish to log into your primary email you will still need to login to something, their approach allows you to choose what sort of login security you'd like (maybe you want 2FA via google, maybe you want a more security lax service) I think password managers are great but the service I see them providing that has the most benefit is to reduce the number of passwords the user needs to actively remember. The single sign on approach has it's weaknesses but the idea itself is pretty sound, you should legitimately trust facebook or google or whoever to know more about secure authentication than some random site... the fact that this service comes with a privacy leak and implies greater online presence tracking is terrible, but the core idea is sound. It'd just be nice to have a neutral party doing it.

snarf21 8y ago

It is generally always a trade-off between security and convenience. You can demand that a site allow passwords but you also aren't memorizing a 24 character nonsense password for each site login. The holy grail is can you bend the line and have something that is super secure and mostly convenient.

meuk 8y ago
I currently work in an environment where I don't have access to a password manager, yet I am expected to have unique passwords for each service, and rotate passwords every month, and am not allowed to store passwords somewhere. Of course, this method requires you to remember more passwords than practically possible. If all accounts would have sane restrictions on the password it would become trivial to have something both secure and convenient. I have been looking for a system that allows me to: 1. Does not require me to remember an absurd amount of information. 2. Allows me to login to services, even from other devices. 3. Has a unique password for each service (so that it is not disastrous if one password leaks). We could have one master password, use site and username (and maybe a counter, to make it easy to rotate passwords) as salt, and use a hashing or password derivation algorithm to derive a unique password for each service. This would only require you to pick and remember a strong master password.
- jki275 8y ago
  I know that environment well, you pretty much have to come up with a hash function you can do in your head. Is it secure? Maybe you can pull it off. I think most people can't, and that's what leads to people writing down passwords.
  - ryan-c 8y ago
    Writing down passwords is usually less bad than password reuse and use of weak passwords.
    - jki275 8y ago
      Depending on the physical security posture of the location where the passwords are stored, that can be a correct statement. I wouldn't argue "usually" simply because most people aren't smart about where they're stored.

ken 8y ago

Sort of. You're selectively quoting "Write programs to handle text streams, because that is a universal interface" -- but that was from the days when "text" was basically synonymous with "ASCII". Passwords aren't streams, and in the Unicode world, they're not even (predictable) byte arrays. This isn't just hypothetical. There have been recent bugs in major systems where people with non-ASCII passwords couldn't type them. One of the major failings of QR codes for consumer use, IMHO, is that there is no fallback. With UPC, the number is printed right below the barcode, so when it doesn't scan, the clerk can just type in the digits. ASCII digits are universal. Bytes are universal. Text is ... complicated.

cyborgx7 8y ago
The idea of "text is the universal interface" informed the design of unix and it resulted in text streams. But if I apply it to something entirely different, authentication, I come out at passwords. And I wouldn't say that text meant ASCII. My understanding is that it meant text is the thing that could be understood and written by both people and computers.
- ggm 8y ago
  The back story of the work some significant UNIX people did to get UTF8/Unicode into workable state in standards is amazing. Application of brilliant minds to a corner-case problem in international standards. http://doc.cat-v.org/bell_labs/utf-8_history http://doc.cat-v.org/bell_labs/utf-8_history
jniedrauer 8y ago
> ASCII digits are universal. Bytes are universal. Text is ... complicated. All text should be UTF-8. It really shouldn't be complicated in $current_year.
- npongratz 8y ago
  Unicode itself gets pretty complicated: https://en.wikipedia.org/wiki/Unicode_equivalence https://en.wikipedia.org/wiki/Unicode_equivalence

krupan 8y ago

"It is also that you can always enter a password." You are correct, as long as you throw out all the other password advice that, ironically, Troy Hunt has given us about not reusing passwords, making them long or full of hard-to-memorize characters, etc. Once you use secure passwords by making them long and/or hard to memorize, unique for each website, etc., you can't just rely on your brain, fingers, and an awkward on-screen keyboard to "always enter a password." You need your password manager with you, you need privacy so nobody can shoulder surf while you agonizingly peck out your password on your touch screen keyboard (remember everyone learning Kanye's cell phone password recently?), etc. Your statement about universality is only technically true.

codyb 8y ago
I'm not sure it has to be so difficult. It took me about an hour to come up with a scheme for creating long, unique, and random looking passwords that are very easy to remember. Basically I have a prefix of length 7 which is two words, where some of the letters get converted to numbers, and then I use shift to make them into special characters. Then for each website I append a different word that has some meaning for me, and convert the letters to numbers. Then I add a special character at the end. A typical password might look like P!^^w)r$M19175r? Which is very easy for me to remember and type, reasonably long, and certainly not on any lists of most commonly used passwords. Ways you could improve this method would be to have different prefixes for different industries (banking, social media, etc).
- thaumaturgy 8y ago
  Yes, there are this and myriad other schemes to accomplish the same thing. This doesn't much help the average customer service worker who struggles to give correct change if you hand them cash in an amount that's not a round number. Passwords are a thing that need to work for everyone, which means they need to work for the lowest common denominator too, which means the GP is correct to point out that password advice is contradictory: the lowest common denominator cannot both use strong, unique passwords and avoid using some other kind of technology to assist with that.
- 8y ago

irrational 8y ago

Or, what if I don't own a phone? I do own a phone, but my wife does not because she doesn't want one.

cyborgx7 8y ago
I am particularly empathetic to that position, because I didn't own a phone until very recently and it caused a bunch of problems for me. It informed my perspective a lot.

codedokode 8y ago

> It is also that you can always enter a password. If you remember it. You either have to use weaker passwords (for example, same password on several sites) or you won't be able to remember them. Or you can write them down which is pretty secure, but is not it easier just to carry a hardware key instead of a notepad with passwords? Also, once I accidentaly deleted Latin keyboard layout in Linux (yes, it is easy). And having only Russian layout I was unable to enter the password to log in (and even if I could I wouln't be able to use the console). I tried to use on-screen keyboard, but in Debian it cannot input characters not present in keyboard layout.

tim333 8y ago
A bit of a bodge I find works is to make my passwords of the form word+site+number, say Mangohn4234 for HN. Then they are all different, pass the has it been pawned thing and its quite easy to remember Mango 4234 or similar if you use that for them all.