4 ms·

> I think the problem is that people don't understand how to use passwords. They do understand it. They just trade security for laziness.

by amf12 8y ago

sametmax 8y ago
Exactly. The thing is, they keep doing it because... it works. The vast majority of the time, for the vast majority of people, it never results in any issue at all. And solve plenty of their problems.
FooBarWidget 8y ago
Agreed. I've tried educating non-technical friends and family about insecure passwords and how random long strings are more secure. Their responses are: 1. "I can't remember that password! / I don't want to type that!" 2. "I'm a nobody, hackers wouldn't be interested in me. My account has no interesting data." [explanations about botnets doing damage to others go way over their heads] 3. "If someone REALLY wants to hack me then I can't stop them anyway." They think that the inconveniences of secure password practices are not worth it. I don't think a password manager will solve it for them. Especially older family members are "afraid of technology" - they are constantly worried that they will break something, and when something is written on the screen 9 out of 10 times they have no idea what it means. I have enough trouble explaining how copy-paste works — I don't think I can explain them what a password manager is, or how to keep in in sync across their devices, let alone convincing them to pay for such a thing. I've tried the low-tech way. Advising them to use XKCD-style password and writing them down on paper. The result: they keep passwords over multiple pieces of paper/notebooks and they always lose them. I've resorted to PMaaS — Password Management as a Service. In other words: I dictate what passwords they use, and I manage it for them in my password manager. Their login method is to call me to retrieve their login credentials.
- AstralStorm 8y ago
  This does not work, you're a single point of failure. If you say, get sick, family members will override security. Nice try though. I'd recommend an actual password manager instead. Authenticated with biometrics and a simpler local password. Your service does the same, using voice and phone number as biometrics. (Perhaps with recovery question.) Feel free to replace it with sufficiently advanced AI.
  - FooBarWidget 8y ago
    Please, try to be in my shoes. Even teaching copy-paste is so difficult, how do you want me to teach them biometrics? The "I'll manage all your passwords for you" is the only solution that actually works. The ONLY other alternative is that they use 123456 as password everywhere. I already explained why I can't get them to use a password manager.
    - elcomet 8y ago
      So what if 123456 is a sensible password for them? Explain them why they should use a more secure password. If they don't get it's maybe they really don't need a more secure password (they don't care who has access to their accounts, and the likelihood of them being hacked is very low).
      - icebraining 8y ago
        People get killed every day making similar assumptions with automobile safety. The ability for a person to "get it" is not a good indicator of their susceptibility to harm.
    - Guest9812398 8y ago
      What about going back to the notebook idea? You give them a notebook that's called 'Passwords' and it sits on the desk beside their computer. They only write passwords in that notebook, and you can explain to them to write at least 20 random numbers and letters for new passwords. When you visit, you can write those passwords down in your password manager. This way if the book goes missing or there is a disaster, you have a backup.
      - FooBarWidget 8y ago
        They lose the entire notebook. The thing is, they only need login credentials a couple of times a year or so. Things like social media and email are apps that are logged in all the time so they only need to reauthenticate when something is wrong or when a special event happens (like buying a new phone). So that only leaves a thousand different boring things that they only rarely access, like the government ID, the utility company account, the insurance company account, etc. So every time they have no idea where that particular notebook is among their tens of other notebooks, pieces of papers etc.
- AnIdiotOnTheNet 8y ago
  > They think that the inconveniences of secure password practices are not worth it. And they're probably right from their own perspective.
  - TremendousJudge 8y ago
    I honestly don't give a shit about 90% of the services I sign up to that require passwords
criddell 8y ago
I do this for sites that I don't particularly care about. My wife and I have something we call our default password and it's protecting our Hulu account, our newspaper login, our Pandora login, etc...

> I think the problem is that people don't understand how to use passwords. They do understand it. They just trade security for laziness.

by amf12 8y ago

> I think the problem is that people don't understand how to use passwords. They do understand it. They just trade security for laziness.

sametmax 8y ago

Exactly. The thing is, they keep doing it because... it works. The vast majority of the time, for the vast majority of people, it never results in any issue at all. And solve plenty of their problems.

FooBarWidget 8y ago

Agreed. I've tried educating non-technical friends and family about insecure passwords and how random long strings are more secure. Their responses are: 1. "I can't remember that password! / I don't want to type that!" 2. "I'm a nobody, hackers wouldn't be interested in me. My account has no interesting data." [explanations about botnets doing damage to others go way over their heads] 3. "If someone REALLY wants to hack me then I can't stop them anyway." They think that the inconveniences of secure password practices are not worth it. I don't think a password manager will solve it for them. Especially older family members are "afraid of technology" - they are constantly worried that they will break something, and when something is written on the screen 9 out of 10 times they have no idea what it means. I have enough trouble explaining how copy-paste works — I don't think I can explain them what a password manager is, or how to keep in in sync across their devices, let alone convincing them to pay for such a thing. I've tried the low-tech way. Advising them to use XKCD-style password and writing them down on paper. The result: they keep passwords over multiple pieces of paper/notebooks and they always lose them. I've resorted to PMaaS — Password Management as a Service. In other words: I dictate what passwords they use, and I manage it for them in my password manager. Their login method is to call me to retrieve their login credentials.

AstralStorm 8y ago
This does not work, you're a single point of failure. If you say, get sick, family members will override security. Nice try though. I'd recommend an actual password manager instead. Authenticated with biometrics and a simpler local password. Your service does the same, using voice and phone number as biometrics. (Perhaps with recovery question.) Feel free to replace it with sufficiently advanced AI.
- FooBarWidget 8y ago
  Please, try to be in my shoes. Even teaching copy-paste is so difficult, how do you want me to teach them biometrics? The "I'll manage all your passwords for you" is the only solution that actually works. The ONLY other alternative is that they use 123456 as password everywhere. I already explained why I can't get them to use a password manager.
  - elcomet 8y ago
    So what if 123456 is a sensible password for them? Explain them why they should use a more secure password. If they don't get it's maybe they really don't need a more secure password (they don't care who has access to their accounts, and the likelihood of them being hacked is very low).
    - icebraining 8y ago
      People get killed every day making similar assumptions with automobile safety. The ability for a person to "get it" is not a good indicator of their susceptibility to harm.
  - Guest9812398 8y ago
    What about going back to the notebook idea? You give them a notebook that's called 'Passwords' and it sits on the desk beside their computer. They only write passwords in that notebook, and you can explain to them to write at least 20 random numbers and letters for new passwords. When you visit, you can write those passwords down in your password manager. This way if the book goes missing or there is a disaster, you have a backup.
    - FooBarWidget 8y ago
      They lose the entire notebook. The thing is, they only need login credentials a couple of times a year or so. Things like social media and email are apps that are logged in all the time so they only need to reauthenticate when something is wrong or when a special event happens (like buying a new phone). So that only leaves a thousand different boring things that they only rarely access, like the government ID, the utility company account, the insurance company account, etc. So every time they have no idea where that particular notebook is among their tens of other notebooks, pieces of papers etc.
AnIdiotOnTheNet 8y ago
> They think that the inconveniences of secure password practices are not worth it. And they're probably right from their own perspective.
- TremendousJudge 8y ago
  I honestly don't give a shit about 90% of the services I sign up to that require passwords

criddell 8y ago

I do this for sites that I don't particularly care about. My wife and I have something we call our default password and it's protecting our Hulu account, our newspaper login, our Pandora login, etc...