4 ms·

it's so baffling to me that people give ALL their password to a third party, commercial, organization...

by kome 4y ago

blurri 4y ago
Come on now. How is that baffling?
- serf 4y ago
  in what other tech stack is it a good idea to have all your eggs in one basket? that's why it's baffling. The convenience is outweighed by the possible loss.
  - rtpg 4y ago
    What is the alternative strategy? I think for most people before password managers the strategy would be "have one egg".
  - 542458 4y ago
    There are lots of enterprise tech stacks where you have a single (or single-as-possible) centralized secret store… it’s far from uncommon, I.e., Hashicorp Vault, AWS Secrets Manager, Google Cloud KMS.
  - noirbot 4y ago
    What percentage of the population even thinks about "tech stacks"? That's the group of people who probably already is using something else. Everyone else is still catching up to not having a password that's just "password1234" People get their credential compromised via shared passwords way more than compromises of Lastpass or Chrome or 1Password. Sure, it's a bigger risk if your manager is compromised, but for most people it's as much "eggs in one basket" as people only having one bank account which is probably true of nearly everyone.
    - theonething 4y ago
      > password that's just "password1234" it's even worse than that. The world's most common password is... password.
      - olyjohn 4y ago
        I'm not sure about that. According to The Plague, the four most common passwords were God, love, sex and secret.
        klibertp 4y ago
        Wiki says that some companies agree[1] that "123456" and "qwerty" are the most popular. "password" seems to generally be in the top 10. What's interesting on these lists is the presence of Dragon and Monkey - am I mistaken or is it due to CJK users entering a Chinese character that got translated somehow? Wouldn't that mean some of the most popular passwords out there are single unicode characters? Surely not... [1] https://en.wikipedia.org/wiki/List_of_the_most_common_passwords https://en.wikipedia.org/wiki/List_of_the_most_common_passwo...
  - danenania 4y ago
    The alternative is spreading your eggs all over the farm, with no way to keep track of where they all are. Many will be put somewhere, then forgotten about. Do you really think that’s safer?
radicaldreamer 4y ago
It's supposed to be E2E encrypted with your master password plus an additional key.
- j16sdiz 4y ago
  Supposed. But few do research, even fewer do audits.
markmark 4y ago
For most people, non-technical people in particular, their biggest exploit risk is they re-use the same username and password everywhere, one website gets popped and their creds get in the open, and then people use those creds to get into everything else. Anything that gets them to use unique, strong passwords for everything vastly improves their general security, even if they are using a third party, commercial organization.
- Server6 4y ago
  Yep. I fell in the trap of using repeat passwords because I was lazy. One of them leaked and someone overseas started using my personal Plex server. I setup LassPass the next day and changed everything to unique strong passwords. LastPass is cross platform and the convenience is worth what the risk for personal use.
KyleBerezin 4y ago
I don't agree with it but it is far from baffling.
theonething 4y ago
For many, the ease of setup and maintenance is worth the risk. The general population is not going to setup their own open source password manager solution. So going with an easy to use commercial password manager is better than not using one at all.
tylerhou 4y ago
What's the alternative? 1. Have people manage their own secrets storage? Most people don't have the time or ability do this securely either. I'd rather pay someone else to secure infra, code, distribution, encryption, backups, etc. for me. 2. Reuse the same password on every site? One site gets hacked and now you're screwed. 3. Memorize a unique, long password for every site? Not feasible. Third-party/commercial password managers are the best solution for most people, practically speaking.
- postalrat 4y ago
  Passwords suck. Move on to something better.
  - Sakos 4y ago
    I'll be sure to tell the 100+ sites I have saved logins for to move on to something better.
  - matkoniecz 4y ago
    what?
  - codegeek 4y ago
    like what ?
    - quickthrower2 4y ago
      It is a hard one because the only computing/memory device you have with you at all times, requires no batteries and not connected to any networks (yet) and not vulnerable to probing/observation (yet) is your brain! But memory is too unreliable unless everyone trains for it. Crypto keys are great but you can lose them and once shared they are keys to you kingdom. Specific security devices are great but you need to remember to have them with you. They can get lost or broken so you need backups. Google authentication is convenient but they can ban you. It is also a 3rd party to trust. Passwords suck but might be the best of the worst. Advantages: password managers can be used to make password useless for other sites and people conceptually understand it. It is quite a hard problem!
jensvdh 4y ago
Then what should folks do? The alternative is having to "run your own encryption" by running your own Password manager on your own infra or re-using passwords
renewiltord 4y ago
I'll do you one better. This is an encrypted base64 password with access to 5 ETH on Coinbase: U2FsdGVkX19mCN0qo7cyA5EfxgVqPQkygGlHqNgv1jM= Guess it and post here and I'll supply you with the username
userbinator 4y ago
This. And their business model is literally to convince people to trust them with their most valuable secrets. Behold the power of marketing.
SkyPuncher 4y ago
Are you also surprised that people run their entire SaaS business on a third party?

it's so baffling to me that people give ALL their password to a third party, commercial, organization...

by kome 4y ago

it's so baffling to me that people give ALL their password to a third party, commercial, organization...

blurri 4y ago

Come on now. How is that baffling?

serf 4y ago
in what other tech stack is it a good idea to have all your eggs in one basket? that's why it's baffling. The convenience is outweighed by the possible loss.
- rtpg 4y ago
  What is the alternative strategy? I think for most people before password managers the strategy would be "have one egg".
- 542458 4y ago
  There are lots of enterprise tech stacks where you have a single (or single-as-possible) centralized secret store… it’s far from uncommon, I.e., Hashicorp Vault, AWS Secrets Manager, Google Cloud KMS.
- noirbot 4y ago
  What percentage of the population even thinks about "tech stacks"? That's the group of people who probably already is using something else. Everyone else is still catching up to not having a password that's just "password1234" People get their credential compromised via shared passwords way more than compromises of Lastpass or Chrome or 1Password. Sure, it's a bigger risk if your manager is compromised, but for most people it's as much "eggs in one basket" as people only having one bank account which is probably true of nearly everyone.
  - theonething 4y ago
    > password that's just "password1234" it's even worse than that. The world's most common password is... password.
    - olyjohn 4y ago
      I'm not sure about that. According to The Plague, the four most common passwords were God, love, sex and secret.
      - klibertp 4y ago
        Wiki says that some companies agree[1] that "123456" and "qwerty" are the most popular. "password" seems to generally be in the top 10. What's interesting on these lists is the presence of Dragon and Monkey - am I mistaken or is it due to CJK users entering a Chinese character that got translated somehow? Wouldn't that mean some of the most popular passwords out there are single unicode characters? Surely not... [1] https://en.wikipedia.org/wiki/List_of_the_most_common_passwords https://en.wikipedia.org/wiki/List_of_the_most_common_passwo...
- danenania 4y ago
  The alternative is spreading your eggs all over the farm, with no way to keep track of where they all are. Many will be put somewhere, then forgotten about. Do you really think that’s safer?

radicaldreamer 4y ago

It's supposed to be E2E encrypted with your master password plus an additional key.

j16sdiz 4y ago
Supposed. But few do research, even fewer do audits.

markmark 4y ago

For most people, non-technical people in particular, their biggest exploit risk is they re-use the same username and password everywhere, one website gets popped and their creds get in the open, and then people use those creds to get into everything else. Anything that gets them to use unique, strong passwords for everything vastly improves their general security, even if they are using a third party, commercial organization.

Server6 4y ago
Yep. I fell in the trap of using repeat passwords because I was lazy. One of them leaked and someone overseas started using my personal Plex server. I setup LassPass the next day and changed everything to unique strong passwords. LastPass is cross platform and the convenience is worth what the risk for personal use.

KyleBerezin 4y ago

I don't agree with it but it is far from baffling.

theonething 4y ago

For many, the ease of setup and maintenance is worth the risk. The general population is not going to setup their own open source password manager solution. So going with an easy to use commercial password manager is better than not using one at all.

tylerhou 4y ago

What's the alternative? 1. Have people manage their own secrets storage? Most people don't have the time or ability do this securely either. I'd rather pay someone else to secure infra, code, distribution, encryption, backups, etc. for me. 2. Reuse the same password on every site? One site gets hacked and now you're screwed. 3. Memorize a unique, long password for every site? Not feasible. Third-party/commercial password managers are the best solution for most people, practically speaking.

postalrat 4y ago
Passwords suck. Move on to something better.
- Sakos 4y ago
  I'll be sure to tell the 100+ sites I have saved logins for to move on to something better.
- matkoniecz 4y ago
  what?
- codegeek 4y ago
  like what ?
  - quickthrower2 4y ago
    It is a hard one because the only computing/memory device you have with you at all times, requires no batteries and not connected to any networks (yet) and not vulnerable to probing/observation (yet) is your brain! But memory is too unreliable unless everyone trains for it. Crypto keys are great but you can lose them and once shared they are keys to you kingdom. Specific security devices are great but you need to remember to have them with you. They can get lost or broken so you need backups. Google authentication is convenient but they can ban you. It is also a 3rd party to trust. Passwords suck but might be the best of the worst. Advantages: password managers can be used to make password useless for other sites and people conceptually understand it. It is quite a hard problem!

jensvdh 4y ago

Then what should folks do? The alternative is having to "run your own encryption" by running your own Password manager on your own infra or re-using passwords

renewiltord 4y ago

I'll do you one better. This is an encrypted base64 password with access to 5 ETH on Coinbase: U2FsdGVkX19mCN0qo7cyA5EfxgVqPQkygGlHqNgv1jM= Guess it and post here and I'll supply you with the username

userbinator 4y ago

This. And their business model is literally to convince people to trust them with their most valuable secrets. Behold the power of marketing.

SkyPuncher 4y ago

Are you also surprised that people run their entire SaaS business on a third party?