3 ms·

50+, that sounds nice. I have 300+ and they are all 20 char random except where dumb sites required special rules like 14 char max. Asking someone to brain mor

50+, that sounds nice. I have 300+ and they are all 20 char random except where dumb sites required special rules like 14 char max. Asking someone to brain more than 5 good passwords is entirely pointless. We just aren’t wired for that. I’ll agree that secure paper is best for security, but not many people understand what “secure” is. A notebook on your desk isn’t, in a safe is. If I need to log in to AWS at the supermarket, that notebook does me no good.

dontbenebby 8y ago
>I’ll agree that secure paper is best for security, but not many people understand what “secure” is. A notebook on your desk isn’t, in a safe is. If I need to log in to AWS at the supermarket, that notebook does me no good. I agree, what is "good enough" security depends on your threat model. For example, for an older adult who previously used one dictionary word on every site, a small notebook with a list of PWs in a locked desk drawer is a big step forward. I like to tell people to treat passwords they have written down like they would a hundred dollar bill. (You keep it on your person, or lock it up when not in use).
- SlowRobotAhead 8y ago
  >I like to tell people to treat passwords they have written down like they would a hundred dollar bill. (You keep it on your person, or lock it up when not in use). Does that system fall apart if you need to securely and remotely share a password with your mom? Because that is the standard of usability I've been considering.
  - dontbenebby 8y ago
    Who is your threat model when sharing a password with your mom? If it's not the government, isn't a phone call sufficient? Harder to tap, and presumably she knows your voice.
    - SlowRobotAhead 8y ago
      You want to call my mom and read her an 18 char password? I'll give you her number, let me know how it goes! So I think it should be obvious when I say my mom, that's a user I have no control over, I can't yell at, I want to make sure there are no mistakes, and that she can't mess anything up on her end like writing it on a sticky note... If you haven't figured out, mom is the worst possible case for a user. You're getting lost in the details. It should be SIMPLE to securely share credentials or codes or details with someone, and that can't be done if a piece of paper is your system.

dontbenebby 8y ago

>I’ll agree that secure paper is best for security, but not many people understand what “secure” is. A notebook on your desk isn’t, in a safe is. If I need to log in to AWS at the supermarket, that notebook does me no good. I agree, what is "good enough" security depends on your threat model. For example, for an older adult who previously used one dictionary word on every site, a small notebook with a list of PWs in a locked desk drawer is a big step forward. I like to tell people to treat passwords they have written down like they would a hundred dollar bill. (You keep it on your person, or lock it up when not in use).

SlowRobotAhead 8y ago
>I like to tell people to treat passwords they have written down like they would a hundred dollar bill. (You keep it on your person, or lock it up when not in use). Does that system fall apart if you need to securely and remotely share a password with your mom? Because that is the standard of usability I've been considering.
- dontbenebby 8y ago
  Who is your threat model when sharing a password with your mom? If it's not the government, isn't a phone call sufficient? Harder to tap, and presumably she knows your voice.
  - SlowRobotAhead 8y ago
    You want to call my mom and read her an 18 char password? I'll give you her number, let me know how it goes! So I think it should be obvious when I say my mom, that's a user I have no control over, I can't yell at, I want to make sure there are no mistakes, and that she can't mess anything up on her end like writing it on a sticky note... If you haven't figured out, mom is the worst possible case for a user. You're getting lost in the details. It should be SIMPLE to securely share credentials or codes or details with someone, and that can't be done if a piece of paper is your system.