3 ms·
> It’s like writing your master password on a sticky note and putting it in a drawer. People should do this, and people should stop telling other people it's b
by ocdtrekkie 6y ago
> It’s like writing your master password on a sticky note and putting it in a drawer.
People should do this, and people should stop telling other people it's bad security to do this. And then people should stop using password managers.
The idea that the sticky note is bad is hilariously old school, and the result has been everyone putting their passwords in cloud-stored apps instead, which is 10,000% worse than a sticky note.
Remember: If it's on the Internet, your potential attacker is "every human on earth". If it's on a sticky note, your potential attacker is "everyone who can get access to the physical place you keep it". The former will always be an increasing number of billions of Internet users. The latter can be reduced to one or two if you store your sticky note somewhere very secure, like a safe or security deposit box.
Also, for added security... just lie on your sticky note. It doesn't have to be a high entropy lie to befuddle people.
- doctoboggan 6y agoBut you have to agree that memorizing your password is more secure than writing it down.
- ocdtrekkie 6y agoOf course. But not everyone is good at that.
- codetrotter 6y agocorrect battery horse staple, but longer and sensible but still unique, and optionally without space. Make up a sentence that makes sense to you, and remove all the spaces, use all lowercase and no special characters. Forgettable: 5uP3r53kr17P455w00r[)!!11One Memorable: ilikestartrekandhamandbeans I used to have full-disk encryption on one of my machines using a password of the forgettable kind. But then the machine had an uptime of months until a power outage, and I realized that while I was fairly sure of the sentence I had no possibility of remembering all of the uppercase and lowercase and symbol and number substitutions. I lost quite a bit of data that day. After that I began using a sentence that makes sense to me but which is not from a book or anything like that for the FDE on my desktop and external hard drives, and I use the pass phrase frequently. Simplicity and repetition is the key to remember your master password. As for websites I use a password manager, and I sometimes generate passwords with my own diceware software https://github.com/ctsrc/Pgen https://github.com/ctsrc/Pgen but most often I am on my phone or on my laptop and then I use the password generator of the password manager that comes with those Apple devices. I haven’t lost any more data since switching to managing my data encryption and my passwords this way.
- ViViDboarder 6y agoEncryption is a thing. If we can’t trust encrypted data then security the password is worthless anyway as everything is owned. This is why password managers are generally considered secure. They store only client side encrypted blobs and do not store or know your master password. Like you, I have no concerns with storing your master password on paper in a locked drawer or something, but it’s unrealistic to securely store post its for every password you need as well as have them readily accessible.
- ocdtrekkie 6y agoReadily accessible to you is readily accessible to hackers. People should re-evaluate how many things they must have access to everywhere they go. For example, my 2FA tokens are backed up in physical storage. This means if I'm traveling and I lose my phone, I don't have access to them until I get back. But that's a lot safer than leaving them somewhere others can access them too.
- ViViDboarder 6y agoHackers don’t have quantum computers to crack my password vault.
- moltar 6y agoI’m using 1Password and it encrypts the payloads before they are shipped to the cloud. How does that compromise my passwords?
- kentbrew 6y agoThis, of course, is the correct answer.