3 ms·
The basic background is that it's impossible to genuinely create and remember unique passwords for every authentication you need, you will need to have patterns
by giraffe_lady 4y ago
The basic background is that it's impossible to genuinely create and remember unique passwords for every authentication you need, you will need to have patterns or reuses, or keep them "written down" somewhere. AND THEN, it is inevitable that some of those services will have breaches and poor practices, some of your passwords will be exposed.
So the threat model of a "normal user" is that one of their reused passwords will be breached and released, and these services prevent that.
If you are in the situation of being specifically targeted because of a system you have access to, you have an entirely different threat model and should consider the tradeoffs in light of that.
The centralization can't really be avoided and is also somewhat a separate issue. You can weigh the benefits and risks of doing it yourself, keeping it in a physical book or stack of postits, paying one of these companies etc but it has to happen if you're truly using unique passphrases and none of these is free from risk, either of discovery or unrecoverable loss.
- paulryanrogers 4y agoSome mitigations include: - Rotating important passwords, so old copies are less useful - Bucketing into multiple vaults, easier with file based tools like KeePass, though you could have separate accounts on various SAAS vaults - Requesting to be forgotten from old services, especially those which have shared PII and passwords - Hardware 2FA