4 ms·
Am I the only one that thinks that password managers are a terrible idea? Lets take all of a user's credentials (mixing the critical and the trivial) and put t
by ryandvm 5y ago
Am I the only one that thinks that password managers are a terrible idea?
Lets take all of a user's credentials (mixing the critical and the trivial) and put them into a single database and then use Javascript-based browser extensions to control access to the DB. What could go wrong?
The LastPass communications brouhaha from last week was just a whiff of the total shit show we're going to see when the client code from one of these password managers is modified with trojan code and we realize that some group has been slurping up credentials by the billions over the course of a few months.
Seems like the charitable take is that password managers are maybe the best approach to a horrible idea, and the real solution is that we ought to be racing to abolish passwords altogether as soon as possible.
- jrockway 5y agoYes, you're pretty much the only one that thinks password managers are a terrible idea. The alternative is using the same password on every site, which is proven not to work. Even ignoring breaches, you're sending the administrators of your favorite forum or whatever your email password. That rarely ends well. If you generate random 16 character passwords and commit them to memory for every site (likely thousands you'll encounter over your lifetime), then fine, you don't need a password manager. For most other humans, it's a net win. Having said that, passwords are a fundamentally flawed idea. Everyone should be using WebAuthn. Password managers turn "something you know" into "something you have". Webauthn skips the guessable backdoor and just goes right to "something you have". Much safer, and much easier to use!
- politelemon 5y agoI think you're mixing a few aspects of a password management solution. Not all password managers are online (LastPass). Not all password managers require an extension. If you use an offline password manager you don't need to use a browser extension. If your password manager requires a browser extension, it's increasing the risk profile. Password managers are not a terrible idea. Certain implementations of password managers are a terrible idea.
- firepacket 5y agoThis is a huge problem. How do we reliably be sure we are entering credentials in the right place? I am thinking we need to look at a bunch of different factors, but what?
- BuckRogers 5y agoI agree, that's why I've never used anything except KeePass. Biometrics will take over, I definitely love FaceID on my iPhone. It just works and the fail rate is near zero on my 12 mini. FaceID that works similarly to Microsoft Authenticator for approvals should be all I need but we're not quite there yet. Effectively, given that I need FaceID to open MS Authenticator, we are already there.
- f1refly 5y agoBiometrics are not passwords though, biometrics are usernames. They can be forged from something as simple as a regular photograph and you cannot change them.
- BuckRogers 5y agoBiometrics are usenames and passwords in one. You may fool a poor biometric implementation, but I'd challenge anyone to try to break into my iPhone via FaceID.