11 ms·

> The best passwords are truly random strings that are unmemorable Let's not fool ourselves: those are no longer passwords. A password in the "things that you

> The best passwords are truly random strings that are unmemorable Let's not fool ourselves: those are no longer passwords. A password in the "things that you know" sense of Two Factor must be memorable for it to meet that definition. Which is not that this is bad advice, as it remains great advice: if you must use "passwords" at least use random garbage passwords that you cannot possibly remember and store them somewhere safe such as a Password Manager. What it does point out is that passwords are broken and have been for some time now. Those of us with the wherewithal to use random garbage backed by password managers have already been living in the "passwordless future". Certainly it is a different "passwordless" than what Microsoft has done, but it is in base principle the exact same thing: using a "something you have" factor (password manager). Certainly a number of specifics differ and in theory if you've bothered to setup your own you are more likely to be using a (unique) strong "pass phrase" as a master key and at least keeping it "something you know by-proxy". I appreciate the stance that Microsoft's "passwordless" requires you to give Microsoft more control than other options, but I think we need to be very clear that "passwordless" is the goal whether it is "passwordless" via tools such as password manager or "passwordless" via device hardware keys and biometrics engines. Passwords in the traditional sense of "secret you have memorized" have never really worked well and we should get rid of them. (And they were broken long before the bad password policies that Microsoft helped enable that required constant password rotation.)

jareklupinski 5y ago
This was the realization that made me backburner my physical password manager project https://github.com/jareklupinski/zamek https://github.com/jareklupinski/zamek I'm more interested in exploring ways to ease the burden of "thing you know" for a lossy human mind, than racing to the bottom of "thing you have" with a bunch of other hardware vendors. So far I really like those spinning wheel codexes you can keep on a keychain :) Looks random to everyone else but only I know the exact pattern to turn jumble into password.
forty 5y ago
You would still login to your password manager using a (human memorable) password, so that would still count as something that you know ;) (it's true though that many password managers will allow you to use some second factor to login)
- WorldMaker 5y ago
  Yes I mentioned that many password manager setups are at least "something you know by-proxy" if you have a password/pass phrase associated. (Keep in mind not all password managers require that, such as the default ones in most browsers.)
cptskippy 5y ago
> Those of us with the wherewithal to use random garbage backed by password managers ...have documented all of the sites we visit and all of the authentication for them in one convenient package? Don't get me wrong, I use a password manager too but it's mostly because of the inconsistent password requirements most sites have making using the same password for all of them impossible. If someone compromises my password manager then they have access to even more information than if they had a single password for all the sites I use.
- popotamonga 5y ago
  Offline password manager. Keepass. Downside is it's up to you to not lose the data.
- Dylan16807 5y ago
  If you use one password and it leaks, it's almost as bad as leaking a password manager. The attacker can just try it out on all the sites they care about. And it's much more likely to happen.
  - cptskippy 5y ago
    Yes that's absolutely true. I know this isn't true of everyone but I personally use a unique email address for every site I engage with making it less likely, though not impossible, for something like that to happen.
- WorldMaker 5y ago
  Absolutely. Depending on your threat model a password manager is exactly the same sort of "single point of failure" as Microsoft's "passwordless" implementation with a worse added huge information disclosure risk on a successful attack. It's more reason I consider our current collective "password" approach broken. Passwords don't scale at a human level and password managers full of "random garbage" passwords are a great workaround for that, but they have their own threat models and risks and accidental information disclosures to worry about. I believe we need to keep in mind that it is a workaround.
- 5y ago
debaserab2 5y ago
This is the #1 reason I am all in on Chrome even though I don't really want to be. I'd like to be using some other Chromium based browser, but I can't really leave my passwordless life, and Chrome makes it all too easy to sync my garbage passwords across all devices with Chrome installed (which is available pretty much everywhere).
- mahathu 5y ago
  Bitwarden is really good for this also. I had the same concerns before I started using it! Works great on mobile too
- travoc 5y ago
  You can use a Keepass database synced across devices with iCloud, etc. That lets you escape the Chrome spyware dependency. Keepass extensions integrate well with all browsers, even those on iOS.
- amachefe 5y ago
  Firefox has the same feature, i have been more firefox user since Chrome was hanging my system sometime ago
- silisili 5y ago
  Brave, Firefox, and I believe Opera all do this also. I use Brave everywhere for the adblocking, but same gist. I get aggravated anymore when I find a site that I don't have credentials stored, or that refuse to work with Brave(looking at you, US Bank).
- cheschire 5y ago
  https://support.1password.com/import-chrome/ https://support.1password.com/import-chrome/
jonny_eh 5y ago
Except that password managers still need "something you know" to get access, a password. That's why one of the most popular managers is called 1Password.
- WorldMaker 5y ago
  I did mention that in some cases it is at best "something you know by-proxy". Keep in mind though: the average user that uses any password manager installed in their browser. If they've turned on password sync they've got it connected to their Apple/Firefox/Microsoft/Google account (and its username/password/what-have-you), but by default the browser as a password manager in most browsers does not require a login of any sort and does not require a "master password" or "master key phrase".
  - Dylan16807 5y ago
    I think most mac browsers use the keyring, and I know chrome on windows uses CryptProtectData which is fine. Those both depend on your login password. Firefox won't be secure by default but the average user isn't on Firefox these days.
Dylan16807 5y ago
> A password in the "things that you know" sense of Two Factor must be memorable for it to meet that definition. You've never memorized a random garbage password? Passwords don't have to be memorable. (Unless by 'memorable' you mean 'able to be memorized', in which case all random strings are 'memorable'.)
- WorldMaker 5y ago
  Sure, a person can memorize one, maybe a dozen "random garbage" passphrases in their life-time. It doesn't scale from a human perspective to one-per-site, which is why to follow that advice you *have to* use a password manager at which point they aren't memorable/things you know, they are things you have (in a passsword manager).
  - Dylan16807 5y ago
    A password manager ties them all together into one thing you know, but it's still a thing you know. The database by itself will be useless under a reasonable configuration.
    - WorldMaker 5y ago
      That's why I said it was at best "something you know by-proxy". It isn't "something you know" that you share with either the IdP or the RP, but "something you know" that you share with "something you have" (your password manager), which in this case is a proxy known to neither your IdP nor your RP in most scenarios. It's a useful workaround to have "something you know by-proxy", but it doesn't really meet the strict definition of the factor.
  - jhanschoo 5y ago
    A password manager is not the only solution. A memorized good-enough hash function operating on (fixed-salt, service provider's name, possibly a salt storable in plaintext perhaps accessible to public)->unique password is very strong for most people and is more portable than a password manager.
Aerroon 5y ago
>Passwords in the traditional sense of "secret you have memorized" have never really worked well and we should get rid of them. No, we shouldn't. Passwords, as they are allow me to use whatever means I choose to remember the key. I can memorize the password, I can use a password manager or I can even derive the password based on some rules I've made up. The choice is mine. A passwordless future is almost certainly going to remove that choice from me. If you told me that in 30 years you need to insert your national ID card into your computer to log in or to browse the web, I would believe you. And I would much rather have broken things instead of that kind of dystopic future.
- WorldMaker 5y ago
  It's a lovely illusion of choice, yes. I'd personally rather see us invest time in "passwordless" systems that provide their own choices/alternatives, but in a collectively strong way where the weakest link in our security chains aren't bad password policies and massive password leaks from database compromises. (How many banks still require passwords that have no symbols in them because they are overly afraid of injection hacks and would rather have users use weaker passwords? How sites in general still require tiny passwords because of choices in varchar(16) that haunt them to this day, or worse COBOL tools with exact sized binary fields that still need to have those passwords in them? How many sites do we need to see added to the database of something like pwnedpasswords/haveibeenpwned before enough is enough?) I'm absolutely not saying that Microsoft's approach to "passwordless" is the best one, and certainly "national ID card" is a very scary straw-man that comes up a lot in these discussions! I am saying that we have to start from the perspective of passwords are broken for us the power users (and our lovely workaround the modern password manager) just as much as for average users that don't understand what is going on technically. We need to get rid of passwords. If we work together today we can try to build standards that get rid of passwords and still provide (especially for power users) provider choice and hardware choice and all of the little things like that which matter to us. Pretending passwords aren't broken isn't going to get us there, and is more likely to get you that future dystopia where you have no choice rather than appreciating today that passwords need to go and we should be working together on the solutions (twenty years ago) and rather than arguing to maintain the (broken) status quo, now is still a great time to explore and propose alternatives.
softwarebeware 5y ago
> Let's not fool ourselves: those are no longer passwords. A password in the "things that you know" sense of Two Factor must be memorable for it to meet that definition. Diceware passwords are actually a great example of passwords that are truly random and unmemorable, yet can be memorized easily
recursive 5y ago
Who's fooling who? This distinction sounds a lot like the "no true password" fallacy. In the common usage, passwords are not as narrowly defined as your usage here. I'm sure you're familiar with the trope of people writing passwords on post-it notes. Would that make it not actually a password? I don't think so. I don't think most other people do either. I'm definitely not convinced that the brave new password-less future is an improvement. I still don't understand how I'm supposed to log in to the same account on two different devices. WebAuthN and others seem to just punt. "That's the relying party's problem". It feels a lot to me like I'm slowly getting funneled into some MegaCorp's identity database. No thanks. I'll get rid of my passwords when someone can show me something better.
- WorldMaker 5y ago
  There are decades of computer history telling users that they are never allowed to write a password done on paper or post-it notes. It's not a new "no true password" fallacy, it's a deep one in the history of computing. I think the fact that so many average users are scared to write their passwords down because of bad 1960s security advice is it's own indicator that passwords are broken that can be a long rant to itself. I don't know if WebAuthN is the answer either. I just know that passwords are broken.
babypuncher 5y ago
People consistently forget the human element when talking about what constitutes "good" security. Sometimes trading a small amount of entropy for a reduction in user friction has the effect of making a system functionally more secure, even if it is hypothetically easier to crack. It might be easier for Microsoft's new passwordless options to be broken by some good social engineering, but its ease of use over relying on a password manager means users are more likely to abandon that sticky note on their monitor or their re-used easily guessable password.
gfody 5y ago
it's really the bad policies that ruined passwords ala https://xkcd.com/936 https://xkcd.com/936
1vuio0pswjnm7 5y ago
"This passwordless future requires that Microsoft follow in Apple's and Google's footsteps in deciding which software you are allowed to run on your computer." "These vendors don't trust you to manage your own security, instead they want you to hand all trust over to them." "This requirement puts even more control of your hardware into Microsoft's hands." Whether the concept of the "password" is appropriate for computers doesnt really interest me. However when companies like Microsoft want to control how I can use a computer, thats a problem. These proposals are not about "security" in every case, they are about control. The user could be in a situation where security really isnt a major concern (and thats for the user to decide) but these companies will still be able to control what she can and cannot do.
- marcus_holmes 5y ago
  > and thats for the user to decide I'm getting a vaccination vibe here. If being slack about security means a botnet infection that the rest of us have to deal with, then no, not for the user to decide. "My computer my choice" only works if you're not connected to a network and can't infect anyone else.
  - 1vuio0pswjnm7 5y ago
    I'm fully vaccinated. I would bet the Pur.ism folks are vaccinated, too. Vaccination is a government initiative. Microsoft is a private company. Originaly Windows had no ability to connect to the internet; it was for LANs only. All was well. Gates originally thought the internet made no sense. Then Microsoft added TCP/IP from BSD and people started connecting Windows to the internet. All was not well. Today, Microsoft actually tries to force people to connect to the internet, and stay connected 24/7. They do this with "automatic upgrades/updates". Windows computers will even try to automatically "update" themselves peer-to-peer from other computers on the LAN. Hows that for a virus analogy. Microsoft could never stop botnets targeting Windows proactively so Microsoft became a botnet. They now have remote command and control. The root cause of botnets isn't the victims, it's the product. Its especially difficult to argue otherwise when owners have less and less control over their own computers.
danparsonson 5y ago
> A password in the "things that you know" sense of Two Factor must be memorable for it to meet that definition. Nonsense - it's even in TFA: > The best passwords are truly random strings that are unmemorable "Something you know" isn't necessarily "something you memorised" - I 'know' my credit card number by virtue of having the card but I can't rattle it off on command without looking it up. A password simply has to be information only you have access to - something you know - as opposed to a physical device that generates a token - something you have.
- deleted 5y ago
  [deleted]
bodge5000 5y ago
As a regular user of a password manager, my main problem with them is that its just another dependency, and quite an important one, in the chain. If my password manager service goes down, I'm buggered. Of course you could use a paper password manager, but again you could lose that, and also it just gets exponentially more difficult to manage as you add more passwords and get more complex, and most people will eventually start simplifying/reusing their passwords until theres no point in having the manager I've found passphrases a good middle ground, but truthfully theres again a limit to how many you could remember reliably, causing again reuse. Hence why I'm still using a password manager, it's just not ideal I suppose.
- YetAnotherNick 5y ago
  > If my password manager service goes down, I'm buggered Most vaults support offline storage.
  - blitzar 5y ago
    I keep an offline copy in my safe.
  - bodge5000 5y ago
    Yeh thats true, I did think about offline vaults after making this comment but I feel theres still a dependency somewhere. I guess even if you have offline storage, you still need a way to get that onto other devices. I guess you'd just sign up for a new service.
raxxorrax 5y ago
I disagree a bit here. I like passwords and this fad really gets on my nerves. I like to authenticate with a passphrase because easy always wins in computer science. Ever used extended authentication against MS services where you have to register your app to get a specific API key? Me neither because I stopped interfacing them, the hassle was too much. Passwords aren't that difficult if you have a system which works as a seed to calculate passwords for a service where a leak doesn't allow for conclusions in the other direction. Ok, not that easy, but manageable. You could use a std password and append the name of the service and in most cases that would suffice if your plaintext pwds don't leak. I have no problem with this fad if we keep passwords as a option. I can live with certs, but I also stopped using github already, even if I rarely used the pwd option at all. Microsoft wants me to install their silly app. Already had it once, didn't like it and I don't trust their apps on my phone. I already hate when services profile my machine. I use many of those and at some point I already stopped using services because I didn't want to check my mail again... Security theatre and other ambitions to the largest degree. I have no problem with that if you give me the option. My passwords do work. Those of other people also work in most cases. There are sometimes these service accoutns which use 'batman' as a password. That is bad and lazy but also a solvable problem. I would argue that password policies are bad too, aside mabye from length. Adding any other rule is silly and compromises security and accessibility in my opinion.
peakaboo 5y ago
This is just another step towards people having citizen passes (renamed covid health passes), and their entire identity will be stored on them, including their personal login to the internet, authorised by the tech mafia. What they are doing is anti-freedom, anti-privacy, and anti-human in the end. The kind of future they want in the name of "security" will be dystopian.

jareklupinski 5y ago

This was the realization that made me backburner my physical password manager project https://github.com/jareklupinski/zamek https://github.com/jareklupinski/zamek I'm more interested in exploring ways to ease the burden of "thing you know" for a lossy human mind, than racing to the bottom of "thing you have" with a bunch of other hardware vendors. So far I really like those spinning wheel codexes you can keep on a keychain :) Looks random to everyone else but only I know the exact pattern to turn jumble into password.

forty 5y ago

You would still login to your password manager using a (human memorable) password, so that would still count as something that you know ;) (it's true though that many password managers will allow you to use some second factor to login)

WorldMaker 5y ago
Yes I mentioned that many password manager setups are at least "something you know by-proxy" if you have a password/pass phrase associated. (Keep in mind not all password managers require that, such as the default ones in most browsers.)

cptskippy 5y ago

> Those of us with the wherewithal to use random garbage backed by password managers ...have documented all of the sites we visit and all of the authentication for them in one convenient package? Don't get me wrong, I use a password manager too but it's mostly because of the inconsistent password requirements most sites have making using the same password for all of them impossible. If someone compromises my password manager then they have access to even more information than if they had a single password for all the sites I use.

popotamonga 5y ago
Offline password manager. Keepass. Downside is it's up to you to not lose the data.
Dylan16807 5y ago
If you use one password and it leaks, it's almost as bad as leaking a password manager. The attacker can just try it out on all the sites they care about. And it's much more likely to happen.
- cptskippy 5y ago
  Yes that's absolutely true. I know this isn't true of everyone but I personally use a unique email address for every site I engage with making it less likely, though not impossible, for something like that to happen.
WorldMaker 5y ago
Absolutely. Depending on your threat model a password manager is exactly the same sort of "single point of failure" as Microsoft's "passwordless" implementation with a worse added huge information disclosure risk on a successful attack. It's more reason I consider our current collective "password" approach broken. Passwords don't scale at a human level and password managers full of "random garbage" passwords are a great workaround for that, but they have their own threat models and risks and accidental information disclosures to worry about. I believe we need to keep in mind that it is a workaround.
5y ago

debaserab2 5y ago

This is the #1 reason I am all in on Chrome even though I don't really want to be. I'd like to be using some other Chromium based browser, but I can't really leave my passwordless life, and Chrome makes it all too easy to sync my garbage passwords across all devices with Chrome installed (which is available pretty much everywhere).

mahathu 5y ago
Bitwarden is really good for this also. I had the same concerns before I started using it! Works great on mobile too
travoc 5y ago
You can use a Keepass database synced across devices with iCloud, etc. That lets you escape the Chrome spyware dependency. Keepass extensions integrate well with all browsers, even those on iOS.
amachefe 5y ago
Firefox has the same feature, i have been more firefox user since Chrome was hanging my system sometime ago
silisili 5y ago
Brave, Firefox, and I believe Opera all do this also. I use Brave everywhere for the adblocking, but same gist. I get aggravated anymore when I find a site that I don't have credentials stored, or that refuse to work with Brave(looking at you, US Bank).
cheschire 5y ago
https://support.1password.com/import-chrome/ https://support.1password.com/import-chrome/

jonny_eh 5y ago

Except that password managers still need "something you know" to get access, a password. That's why one of the most popular managers is called 1Password.

WorldMaker 5y ago
I did mention that in some cases it is at best "something you know by-proxy". Keep in mind though: the average user that uses any password manager installed in their browser. If they've turned on password sync they've got it connected to their Apple/Firefox/Microsoft/Google account (and its username/password/what-have-you), but by default the browser as a password manager in most browsers does not require a login of any sort and does not require a "master password" or "master key phrase".
- Dylan16807 5y ago
  I think most mac browsers use the keyring, and I know chrome on windows uses CryptProtectData which is fine. Those both depend on your login password. Firefox won't be secure by default but the average user isn't on Firefox these days.

Dylan16807 5y ago

> A password in the "things that you know" sense of Two Factor must be memorable for it to meet that definition. You've never memorized a random garbage password? Passwords don't have to be memorable. (Unless by 'memorable' you mean 'able to be memorized', in which case all random strings are 'memorable'.)

WorldMaker 5y ago
Sure, a person can memorize one, maybe a dozen "random garbage" passphrases in their life-time. It doesn't scale from a human perspective to one-per-site, which is why to follow that advice you *have to* use a password manager at which point they aren't memorable/things you know, they are things you have (in a passsword manager).
- Dylan16807 5y ago
  A password manager ties them all together into one thing you know, but it's still a thing you know. The database by itself will be useless under a reasonable configuration.
  - WorldMaker 5y ago
    That's why I said it was at best "something you know by-proxy". It isn't "something you know" that you share with either the IdP or the RP, but "something you know" that you share with "something you have" (your password manager), which in this case is a proxy known to neither your IdP nor your RP in most scenarios. It's a useful workaround to have "something you know by-proxy", but it doesn't really meet the strict definition of the factor.
- jhanschoo 5y ago
  A password manager is not the only solution. A memorized good-enough hash function operating on (fixed-salt, service provider's name, possibly a salt storable in plaintext perhaps accessible to public)->unique password is very strong for most people and is more portable than a password manager.

Aerroon 5y ago

>Passwords in the traditional sense of "secret you have memorized" have never really worked well and we should get rid of them. No, we shouldn't. Passwords, as they are allow me to use whatever means I choose to remember the key. I can memorize the password, I can use a password manager or I can even derive the password based on some rules I've made up. The choice is mine. A passwordless future is almost certainly going to remove that choice from me. If you told me that in 30 years you need to insert your national ID card into your computer to log in or to browse the web, I would believe you. And I would much rather have broken things instead of that kind of dystopic future.

WorldMaker 5y ago
It's a lovely illusion of choice, yes. I'd personally rather see us invest time in "passwordless" systems that provide their own choices/alternatives, but in a collectively strong way where the weakest link in our security chains aren't bad password policies and massive password leaks from database compromises. (How many banks still require passwords that have no symbols in them because they are overly afraid of injection hacks and would rather have users use weaker passwords? How sites in general still require tiny passwords because of choices in varchar(16) that haunt them to this day, or worse COBOL tools with exact sized binary fields that still need to have those passwords in them? How many sites do we need to see added to the database of something like pwnedpasswords/haveibeenpwned before enough is enough?) I'm absolutely not saying that Microsoft's approach to "passwordless" is the best one, and certainly "national ID card" is a very scary straw-man that comes up a lot in these discussions! I am saying that we have to start from the perspective of passwords are broken for us the power users (and our lovely workaround the modern password manager) just as much as for average users that don't understand what is going on technically. We need to get rid of passwords. If we work together today we can try to build standards that get rid of passwords and still provide (especially for power users) provider choice and hardware choice and all of the little things like that which matter to us. Pretending passwords aren't broken isn't going to get us there, and is more likely to get you that future dystopia where you have no choice rather than appreciating today that passwords need to go and we should be working together on the solutions (twenty years ago) and rather than arguing to maintain the (broken) status quo, now is still a great time to explore and propose alternatives.

softwarebeware 5y ago

> Let's not fool ourselves: those are no longer passwords. A password in the "things that you know" sense of Two Factor must be memorable for it to meet that definition. Diceware passwords are actually a great example of passwords that are truly random and unmemorable, yet can be memorized easily

recursive 5y ago

Who's fooling who? This distinction sounds a lot like the "no true password" fallacy. In the common usage, passwords are not as narrowly defined as your usage here. I'm sure you're familiar with the trope of people writing passwords on post-it notes. Would that make it not actually a password? I don't think so. I don't think most other people do either. I'm definitely not convinced that the brave new password-less future is an improvement. I still don't understand how I'm supposed to log in to the same account on two different devices. WebAuthN and others seem to just punt. "That's the relying party's problem". It feels a lot to me like I'm slowly getting funneled into some MegaCorp's identity database. No thanks. I'll get rid of my passwords when someone can show me something better.

WorldMaker 5y ago
There are decades of computer history telling users that they are never allowed to write a password done on paper or post-it notes. It's not a new "no true password" fallacy, it's a deep one in the history of computing. I think the fact that so many average users are scared to write their passwords down because of bad 1960s security advice is it's own indicator that passwords are broken that can be a long rant to itself. I don't know if WebAuthN is the answer either. I just know that passwords are broken.

babypuncher 5y ago

People consistently forget the human element when talking about what constitutes "good" security. Sometimes trading a small amount of entropy for a reduction in user friction has the effect of making a system functionally more secure, even if it is hypothetically easier to crack. It might be easier for Microsoft's new passwordless options to be broken by some good social engineering, but its ease of use over relying on a password manager means users are more likely to abandon that sticky note on their monitor or their re-used easily guessable password.

gfody 5y ago

it's really the bad policies that ruined passwords ala https://xkcd.com/936 https://xkcd.com/936

1vuio0pswjnm7 5y ago

"This passwordless future requires that Microsoft follow in Apple's and Google's footsteps in deciding which software you are allowed to run on your computer." "These vendors don't trust you to manage your own security, instead they want you to hand all trust over to them." "This requirement puts even more control of your hardware into Microsoft's hands." Whether the concept of the "password" is appropriate for computers doesnt really interest me. However when companies like Microsoft want to control how I can use a computer, thats a problem. These proposals are not about "security" in every case, they are about control. The user could be in a situation where security really isnt a major concern (and thats for the user to decide) but these companies will still be able to control what she can and cannot do.

marcus_holmes 5y ago
> and thats for the user to decide I'm getting a vaccination vibe here. If being slack about security means a botnet infection that the rest of us have to deal with, then no, not for the user to decide. "My computer my choice" only works if you're not connected to a network and can't infect anyone else.
- 1vuio0pswjnm7 5y ago
  I'm fully vaccinated. I would bet the Pur.ism folks are vaccinated, too. Vaccination is a government initiative. Microsoft is a private company. Originaly Windows had no ability to connect to the internet; it was for LANs only. All was well. Gates originally thought the internet made no sense. Then Microsoft added TCP/IP from BSD and people started connecting Windows to the internet. All was not well. Today, Microsoft actually tries to force people to connect to the internet, and stay connected 24/7. They do this with "automatic upgrades/updates". Windows computers will even try to automatically "update" themselves peer-to-peer from other computers on the LAN. Hows that for a virus analogy. Microsoft could never stop botnets targeting Windows proactively so Microsoft became a botnet. They now have remote command and control. The root cause of botnets isn't the victims, it's the product. Its especially difficult to argue otherwise when owners have less and less control over their own computers.

danparsonson 5y ago

> A password in the "things that you know" sense of Two Factor must be memorable for it to meet that definition. Nonsense - it's even in TFA: > The best passwords are truly random strings that are unmemorable "Something you know" isn't necessarily "something you memorised" - I 'know' my credit card number by virtue of having the card but I can't rattle it off on command without looking it up. A password simply has to be information only you have access to - something you know - as opposed to a physical device that generates a token - something you have.

deleted 5y ago
[deleted]

bodge5000 5y ago

As a regular user of a password manager, my main problem with them is that its just another dependency, and quite an important one, in the chain. If my password manager service goes down, I'm buggered. Of course you could use a paper password manager, but again you could lose that, and also it just gets exponentially more difficult to manage as you add more passwords and get more complex, and most people will eventually start simplifying/reusing their passwords until theres no point in having the manager I've found passphrases a good middle ground, but truthfully theres again a limit to how many you could remember reliably, causing again reuse. Hence why I'm still using a password manager, it's just not ideal I suppose.

YetAnotherNick 5y ago
> If my password manager service goes down, I'm buggered Most vaults support offline storage.
- blitzar 5y ago
  I keep an offline copy in my safe.
- bodge5000 5y ago
  Yeh thats true, I did think about offline vaults after making this comment but I feel theres still a dependency somewhere. I guess even if you have offline storage, you still need a way to get that onto other devices. I guess you'd just sign up for a new service.

raxxorrax 5y ago

I disagree a bit here. I like passwords and this fad really gets on my nerves. I like to authenticate with a passphrase because easy always wins in computer science. Ever used extended authentication against MS services where you have to register your app to get a specific API key? Me neither because I stopped interfacing them, the hassle was too much. Passwords aren't that difficult if you have a system which works as a seed to calculate passwords for a service where a leak doesn't allow for conclusions in the other direction. Ok, not that easy, but manageable. You could use a std password and append the name of the service and in most cases that would suffice if your plaintext pwds don't leak. I have no problem with this fad if we keep passwords as a option. I can live with certs, but I also stopped using github already, even if I rarely used the pwd option at all. Microsoft wants me to install their silly app. Already had it once, didn't like it and I don't trust their apps on my phone. I already hate when services profile my machine. I use many of those and at some point I already stopped using services because I didn't want to check my mail again... Security theatre and other ambitions to the largest degree. I have no problem with that if you give me the option. My passwords do work. Those of other people also work in most cases. There are sometimes these service accoutns which use 'batman' as a password. That is bad and lazy but also a solvable problem. I would argue that password policies are bad too, aside mabye from length. Adding any other rule is silly and compromises security and accessibility in my opinion.

peakaboo 5y ago

This is just another step towards people having citizen passes (renamed covid health passes), and their entire identity will be stored on them, including their personal login to the internet, authorised by the tech mafia. What they are doing is anti-freedom, anti-privacy, and anti-human in the end. The kind of future they want in the name of "security" will be dystopian.