3 ms·

Sure, a person can memorize one, maybe a dozen "random garbage" passphrases in their life-time. It doesn't scale from a human perspective to one-per-site, which

Sure, a person can memorize one, maybe a dozen "random garbage" passphrases in their life-time. It doesn't scale from a human perspective to one-per-site, which is why to follow that advice you *have to* use a password manager at which point they aren't memorable/things you know, they are things you have (in a passsword manager).

Dylan16807 5y ago
A password manager ties them all together into one thing you know, but it's still a thing you know. The database by itself will be useless under a reasonable configuration.
- WorldMaker 5y ago
  That's why I said it was at best "something you know by-proxy". It isn't "something you know" that you share with either the IdP or the RP, but "something you know" that you share with "something you have" (your password manager), which in this case is a proxy known to neither your IdP nor your RP in most scenarios. It's a useful workaround to have "something you know by-proxy", but it doesn't really meet the strict definition of the factor.
jhanschoo 5y ago
A password manager is not the only solution. A memorized good-enough hash function operating on (fixed-salt, service provider's name, possibly a salt storable in plaintext perhaps accessible to public)->unique password is very strong for most people and is more portable than a password manager.
- UncleMeat 5y ago
  > most people I think you dramatically overestimate how many people can do this consistently for years on end. People who don't use a password manager simply reuse passwords. That's what they've always done. Any solution that ignores this observation is doomed to fail.
  - jhanschoo 5y ago
    I disagree, since I think it has more to do with lack of education that this is something you can do; have a simple deterministic algorithm for generating passwords based on your service. It's far more convenient than a password manager, and can avoid the single-point-of-failure.

Dylan16807 5y ago

A password manager ties them all together into one thing you know, but it's still a thing you know. The database by itself will be useless under a reasonable configuration.

WorldMaker 5y ago
That's why I said it was at best "something you know by-proxy". It isn't "something you know" that you share with either the IdP or the RP, but "something you know" that you share with "something you have" (your password manager), which in this case is a proxy known to neither your IdP nor your RP in most scenarios. It's a useful workaround to have "something you know by-proxy", but it doesn't really meet the strict definition of the factor.

jhanschoo 5y ago

A password manager is not the only solution. A memorized good-enough hash function operating on (fixed-salt, service provider's name, possibly a salt storable in plaintext perhaps accessible to public)->unique password is very strong for most people and is more portable than a password manager.

UncleMeat 5y ago
> most people I think you dramatically overestimate how many people can do this consistently for years on end. People who don't use a password manager simply reuse passwords. That's what they've always done. Any solution that ignores this observation is doomed to fail.
- jhanschoo 5y ago
  I disagree, since I think it has more to do with lack of education that this is something you can do; have a simple deterministic algorithm for generating passwords based on your service. It's far more convenient than a password manager, and can avoid the single-point-of-failure.