3 ms·
> Those of us with the wherewithal to use random garbage backed by password managers ...have documented all of the sites we visit and all of the authentication
by cptskippy 5y ago
> Those of us with the wherewithal to use random garbage backed by password managers
...have documented all of the sites we visit and all of the authentication for them in one convenient package?
Don't get me wrong, I use a password manager too but it's mostly because of the inconsistent password requirements most sites have making using the same password for all of them impossible.
If someone compromises my password manager then they have access to even more information than if they had a single password for all the sites I use.
- popotamonga 5y agoOffline password manager. Keepass. Downside is it's up to you to not lose the data.
- Dylan16807 5y agoIf you use one password and it leaks, it's almost as bad as leaking a password manager. The attacker can just try it out on all the sites they care about. And it's much more likely to happen.
- cptskippy 5y agoYes that's absolutely true. I know this isn't true of everyone but I personally use a unique email address for every site I engage with making it less likely, though not impossible, for something like that to happen.
- WorldMaker 5y agoAbsolutely. Depending on your threat model a password manager is exactly the same sort of "single point of failure" as Microsoft's "passwordless" implementation with a worse added huge information disclosure risk on a successful attack. It's more reason I consider our current collective "password" approach broken. Passwords don't scale at a human level and password managers full of "random garbage" passwords are a great workaround for that, but they have their own threat models and risks and accidental information disclosures to worry about. I believe we need to keep in mind that it is a workaround.
- unethical_ban 5y agoThat's why you still use a decently long passphrase and use an offline password manager.