3 ms·

I think it’s mostly for everyone else. I’m very successfully using a password manager. I’ve tried to talk nearly everyone I know into using one as well, and it’

I think it’s mostly for everyone else. I’m very successfully using a password manager. I’ve tried to talk nearly everyone I know into using one as well, and it’s really painful for them. Even for people I can help daily, their setup somehow gets complicated enough that they go back to using their default 5 letter password for new things until I fix it. A password manager can be an extra 10 seconds of work up front in some edge cases — input not detected correctly, signing up in an app, trying to quickly get through a flow when your password manager is logged out… People just revert back to the easiest path, which is their 5 letter password they’ve already used on a billion services. Oh, and another rough edge case is when the autogenerated password doesn’t match the password requirements. Using a disallowed symbol, too long, etc

daenney 5y ago
> Even for people I can help daily, their setup somehow gets complicated enough that they go back to using their default 5 letter password for new things until I fix it. This has been my experience too. For my parents or my siblings no matter what I try we always end up back there. And I understand to a degree, the software is getting in the way of getting something done. I’ve managed to get to the point where at least their email accounts use a non-standard passphrase for them, so the likelihood of it being taken over and used as a reset vector for other accounts is much much smaller. And that’s about the best I can do.
usrbinbash 5y ago
> A password manager can be an extra 10 seconds of work up front in some edge cases There is always a trade-off in security vs. comfort. To me, having a completely secure authentication method that is simple and doesn't rely on any third party services, blorkchains etc. and is completely under my control, is important enough to be worth the occasional 10 seconds of work. > another rough edge case is when the autogenerated password doesn’t match the password requirements Which is why the generator I use allows me to set the character set & max length.
- noahtallen 5y ago
  Which is why I use a password manager, of course :) There simply should not have to be this trade off. I know how to adjust the generator for the rules. But on my phone, that’s a fair amount of extra work and you have to know how to do it. For non-tech peers, they won’t know how to learn that, and they’ll likely not understand the trade-off well enough to do it anyways. So we’re back at the beginning: passwords need to be secure by default — without going through any extra steps, or we need a different approach that is secure without extra work.

daenney 5y ago

> Even for people I can help daily, their setup somehow gets complicated enough that they go back to using their default 5 letter password for new things until I fix it. This has been my experience too. For my parents or my siblings no matter what I try we always end up back there. And I understand to a degree, the software is getting in the way of getting something done. I’ve managed to get to the point where at least their email accounts use a non-standard passphrase for them, so the likelihood of it being taken over and used as a reset vector for other accounts is much much smaller. And that’s about the best I can do.

usrbinbash 5y ago

> A password manager can be an extra 10 seconds of work up front in some edge cases There is always a trade-off in security vs. comfort. To me, having a completely secure authentication method that is simple and doesn't rely on any third party services, blorkchains etc. and is completely under my control, is important enough to be worth the occasional 10 seconds of work. > another rough edge case is when the autogenerated password doesn’t match the password requirements Which is why the generator I use allows me to set the character set & max length.

noahtallen 5y ago
Which is why I use a password manager, of course :) There simply should not have to be this trade off. I know how to adjust the generator for the rules. But on my phone, that’s a fair amount of extra work and you have to know how to do it. For non-tech peers, they won’t know how to learn that, and they’ll likely not understand the trade-off well enough to do it anyways. So we’re back at the beginning: passwords need to be secure by default — without going through any extra steps, or we need a different approach that is secure without extra work.