4 ms·
> Using a password manager without a master password is way more secure than not using a password manager at all. I disagree, diceware AND hardware security ke
by tomxor 4y ago
> Using a password manager without a master password is way more secure than not using a password manager at all.
I disagree, diceware AND hardware security keys, is stronger, no password manager needed at all.
However I agree the article is overblown. For most people, browser based password managers are probably a vast improvement, since most will likely never educate themselves on such things or accept the solutions as personally viable. The browser is right there and even prompts them into using it.
- zokier 4y agoHow does diceware reduce the need for password managers at all?
- tomxor 4y agoBecause they are significantly more memorable than pw made from individually random chars without significantly reducing their strength. I have a handful of diceware passwords for important accounts i need to remember, and find that pretty easy... the rest are throwaway level unimportant or I leave to email based login. However I dictate password and security policies where I work, and don't have to adhere to stupid "change your pw every week" rules - so i realise this is not a solution for everyone working under different (stupid) conditions. https://xkcd.com/936/ https://xkcd.com/936/
- zokier 4y agoI have about 200ish passwords in my password manager. No matter how memorable any of those is individually, remembering 200 secure secrets is not practical. Nevermind the fact that many of those are used extremely rarely, good luck rembering diceware password that you use once in couple of years
- tomxor 4y agoThat's fair, but I'd ask yourself: of those 200 how many are important enough to warrant a strong password? and of those how many are important and frequently used enough to need to be independent of email based authentication? Perhaps you don't need to remember as many as you think.