24 ms·

Surely the whole point of a password manager is to have a different long complex password for each system you login to without needing to remember any of them b

Surely the whole point of a password manager is to have a different long complex password for each system you login to without needing to remember any of them but your master password?

TheSpiceIsLife 7y ago
What part of the parent comment are you replying to?
- javajosh 7y ago
  I think he means that a password manager (PM) renders the other two points moot. Password expiry? No problem - my PM generates a new one easily. Complex rules? No problem - my PM will follow any rules you like. My response is that not everyone uses a PM, so the other two points are not moot. Also, FWIW, I find myself rather uneasy about using a PM, so the other two points aren't moot, at least for me. "One password to rule them all" means that you've created one nice big juicy target that needs to be breached once, versus a bunch of little targets that have to each be breached individually. To take one real-life example, if the TSA wants to rifle through your digital life, it will be much, much harder for them if you don't have a PM.
  - mcny 7y ago
    Sorry but I don’t understand how I’d use a password manager to unlock my computer. This password is for my active directory account and I hate that it expires every three months.
    - input_sh 7y ago
      So do I, and I manage the AD for my organization.
    - tialaramex 7y ago
      Try to get the AD policy revised. Because there is (since 2017) clear NIST guidance saying not to do this, chances are that somewhere in your organisation a document can be updated to cite that NIST guidance and then the AD controls can be relaxed to let passwords have the same lifetime as the account they're for. Finding who owns this policy and getting them to fix it may take a bit longer than one of those 90 day password changes, but it'll feel like you made the world better and it may only take a phone call or an email to the right person. Newer Windows AD builds have FIDO2 support, so on shiny new computers you _could_ unlock "your" computer (one you've logged into recently) with a FIDO2 USB key, or a fingerprint reader. That's a much nicer way to unlock a computer you use all the time, while not discouraging you from using a nice long password that bad guys would need to guess or steal to get in from a different machine.
    - benhurmarcel 7y ago
      My login/AD password expires every month, and you can't reuse one from the last year. But in the end it's not too bad, because you just append a number to your password and that's it. Most people have a post-it on their screen with the last number they used. It's useless, but not worth my energy to fight.
  - nicky0 7y ago
    I'm not too concerned about "one to rule them all" since it basically already exists — my email login. Get that and you have everything.
nicky0 7y ago
Well yes, but unless absolutely everyone uses a password manager then you also have to allow non-expiring memorable passphrases.

Surely the whole point of a password manager is to have a different long complex password for each system you login to without needing to remember any of them but your master password?

TheSpiceIsLife 7y ago

What part of the parent comment are you replying to?

javajosh 7y ago
I think he means that a password manager (PM) renders the other two points moot. Password expiry? No problem - my PM generates a new one easily. Complex rules? No problem - my PM will follow any rules you like. My response is that not everyone uses a PM, so the other two points are not moot. Also, FWIW, I find myself rather uneasy about using a PM, so the other two points aren't moot, at least for me. "One password to rule them all" means that you've created one nice big juicy target that needs to be breached once, versus a bunch of little targets that have to each be breached individually. To take one real-life example, if the TSA wants to rifle through your digital life, it will be much, much harder for them if you don't have a PM.
- mcny 7y ago
  Sorry but I don’t understand how I’d use a password manager to unlock my computer. This password is for my active directory account and I hate that it expires every three months.
  - input_sh 7y ago
    So do I, and I manage the AD for my organization.
  - tialaramex 7y ago
    Try to get the AD policy revised. Because there is (since 2017) clear NIST guidance saying not to do this, chances are that somewhere in your organisation a document can be updated to cite that NIST guidance and then the AD controls can be relaxed to let passwords have the same lifetime as the account they're for. Finding who owns this policy and getting them to fix it may take a bit longer than one of those 90 day password changes, but it'll feel like you made the world better and it may only take a phone call or an email to the right person. Newer Windows AD builds have FIDO2 support, so on shiny new computers you _could_ unlock "your" computer (one you've logged into recently) with a FIDO2 USB key, or a fingerprint reader. That's a much nicer way to unlock a computer you use all the time, while not discouraging you from using a nice long password that bad guys would need to guess or steal to get in from a different machine.
  - benhurmarcel 7y ago
    My login/AD password expires every month, and you can't reuse one from the last year. But in the end it's not too bad, because you just append a number to your password and that's it. Most people have a post-it on their screen with the last number they used. It's useless, but not worth my energy to fight.
- nicky0 7y ago
  I'm not too concerned about "one to rule them all" since it basically already exists — my email login. Get that and you have everything.

nicky0 7y ago

Well yes, but unless absolutely everyone uses a password manager then you also have to allow non-expiring memorable passphrases.