3 ms·

All valid points. But there two other main reasons I see as why (strong) passwords are essentially a superior choice to everything: 1) Using passwords properl

All valid points. But there two other main reasons I see as why (strong) passwords are essentially a superior choice to everything: 1) Using passwords properly is an exceptionally powerful way of protecting your account/data/etc. If you use strong, unique passwords and store in a password manager (with the PW database encrypted, of course), it's virtually impossible to break into anything on the user side of things. You might be able to gain access via the server/business side depending on the hack you are pulling off, but that's on the company rather than the user. For instance, I do personally have my passwords stored in a password manager with an encrypted database. They're all unique and strong, as is the password used to access the password database. That password exists only in my mind. It's not written down anywhere or stored in some file on any computer. It's not physically printed out on paper or anything like that. It literally only exists in my head. And given its complexity and length, there is effectively nothing that will be able to break it in any reasonable amount of time. The government also can't force it from me as they could with other methods like 2FA, QR codes, fingerprints, etc. due to 1st amendment issues. Basically, short of getting me to log in from a compromised (i.e. keylogged) device (highly unlikely) or torturing me for the info, there's no way of getting it. And if you're willing to torture me for it - ok, you win then. 2) From a technical point - basically every device we would use to log into anything has either a keyboard (whether physical or on-screen) or some sort of keypad (again, physical or on-screen). This makes for universal compatibility. If people need to have special QR-code scanning/creation software installed on a device, or fingerprint-reading hardware - that creates a non-trivial barrier to the device compatible with the login process.

krupan 8y ago
"If you use strong, unique passwords and store in a password manager (with the PW database encrypted, of course)" You aren't talking about passwords the same way everyone else here, especially TFA, is talking about passwords. You might as well be talking about RSA keys at this point.
- tialaramex 8y ago
  Perhaps more appropriately AES keys, as they are a shared secret (shared with the target site even if it's using a decent password hash) rather than a private key.
SnacksOnAPlane 8y ago
For #1, the master password gets entered in when you need to decrypt the password file, right? Doesn't that mean that anyone who can read the input stream from your keyboard can decrypt all your passwords? I mean, I use a password manager because it's the least-shitty way I can think of to not reuse passwords, but to me it's a matter of when and not if some bad guy manages to insert malware into the password manager code and get all the passwords.
- turc1656 8y ago
  Correct. That's why I mentioned the keylogger risk.

krupan 8y ago

"If you use strong, unique passwords and store in a password manager (with the PW database encrypted, of course)" You aren't talking about passwords the same way everyone else here, especially TFA, is talking about passwords. You might as well be talking about RSA keys at this point.

tialaramex 8y ago
Perhaps more appropriately AES keys, as they are a shared secret (shared with the target site even if it's using a decent password hash) rather than a private key.

SnacksOnAPlane 8y ago

For #1, the master password gets entered in when you need to decrypt the password file, right? Doesn't that mean that anyone who can read the input stream from your keyboard can decrypt all your passwords? I mean, I use a password manager because it's the least-shitty way I can think of to not reuse passwords, but to me it's a matter of when and not if some bad guy manages to insert malware into the password manager code and get all the passwords.

turc1656 8y ago
Correct. That's why I mentioned the keylogger risk.