3 ms·
What's wrong with forgetting passwords? After a period of trying to use diffent passwords on different sites, I recently gave up and just type in some gibberish
by ferzul 7y ago
What's wrong with forgetting passwords? After a period of trying to use diffent passwords on different sites, I recently gave up and just type in some gibberish pattern I can reproduce three times (maybe via the clipboard), and then use password reset next time I need to log in.
Is this desperately insecure?
It doesn't work for everything I guess - online banking, email, work MS password. But if it's only three nonshared passwords it's tolerable.
- CydeWeys 7y agoForgotten passwords require the use of password reset flows, and password reset flows are a notorious security weak point, whether it's because the security question answers can be gotten from publicly available information or guessed, or the email or SMS used for the reset flow is compromised, or the codes used are too short and can be brute-forced, or a variety of other issues. The safest password is one that is never forgotten, and that has a truly onerous password reset flow, e.g. needing to go in person with ID to get it reset, potentially with someone else to vouch for you (how it works at many companies). Password reset flows are ways to get around the password mechanism itself, and the more often people forget their passwords, the smoother that flow (i.e. password bypass) needs to be.