3 ms·

I believe it's the opposite. Every shared account increases my exposure as the user. If I have 500 accounts across 500 sites, and one is compromised, 499 are no

I believe it's the opposite. Every shared account increases my exposure as the user. If I have 500 accounts across 500 sites, and one is compromised, 499 are not. If I have 1 account across 500 sites, and that one account is compromised, all 500 sites and the data I have there, is at risk.

WorldMaker 4y ago
Though real world evidence suggests that the more accounts you use the less likely you are to use strong passwords and the more likely you are to reuse passwords. It's not a big difference if because someone has 500 accounts they have 1 password across all 500 and a breach of one account is still a breach of all of them. With the added fun that dealing with that breach requires 500 touch points to change passwords. You may not personally be in that situation. If you read HN you probably use a password manager. The average user generally is in this situation. Consolidating accounts decreases their exposure of weak passwords. It's a different conversation if we are using something stronger than passwords, but today 500 passwords is inhumane and increases the attack surface of average users.
- antifa 4y ago
  Then we need to encourage more users to use password managers. I propose registration screens should recommend at least bitwarden. Website password complexity rules should warn and enforce that MFA will be required for passwords less than 72 characters.
  - WorldMaker 4y ago
    If you're just going to enforce MFA on weak passwords anyway, what do you need the weak passwords for exactly? This is almost the exact line of reasoning why Microsoft, Apple, and Google have (finally) all agreed to work together to eliminate passwords altogether. Which probably is the only way that we can solve this: eliminate passwords, use proper keys and attestations instead of passwords, and try to make the user experience as nice as possible and at least no worse than yesterday's TOTP 2FA. (And yes, there are lots of valid complaints for power users that know how to use a password manager today that any such key management platforms would be a worse single point of failure than their existing password manager because it would be more opaque and harder to user-manage/export. It's an interesting trade off for average user security, at least.)

WorldMaker 4y ago

Though real world evidence suggests that the more accounts you use the less likely you are to use strong passwords and the more likely you are to reuse passwords. It's not a big difference if because someone has 500 accounts they have 1 password across all 500 and a breach of one account is still a breach of all of them. With the added fun that dealing with that breach requires 500 touch points to change passwords. You may not personally be in that situation. If you read HN you probably use a password manager. The average user generally is in this situation. Consolidating accounts decreases their exposure of weak passwords. It's a different conversation if we are using something stronger than passwords, but today 500 passwords is inhumane and increases the attack surface of average users.

antifa 4y ago
Then we need to encourage more users to use password managers. I propose registration screens should recommend at least bitwarden. Website password complexity rules should warn and enforce that MFA will be required for passwords less than 72 characters.
- WorldMaker 4y ago
  If you're just going to enforce MFA on weak passwords anyway, what do you need the weak passwords for exactly? This is almost the exact line of reasoning why Microsoft, Apple, and Google have (finally) all agreed to work together to eliminate passwords altogether. Which probably is the only way that we can solve this: eliminate passwords, use proper keys and attestations instead of passwords, and try to make the user experience as nice as possible and at least no worse than yesterday's TOTP 2FA. (And yes, there are lots of valid complaints for power users that know how to use a password manager today that any such key management platforms would be a worse single point of failure than their existing password manager because it would be more opaque and harder to user-manage/export. It's an interesting trade off for average user security, at least.)