3 ms·

I don't "know" any of my passwords anymore! First it was "use complex passwords" so passwords got harder to remember, but it was doable. Then it was "don't reu

I don't "know" any of my passwords anymore! First it was "use complex passwords" so passwords got harder to remember, but it was doable. Then it was "don't reuse your passwords" and I'd made a good show of it by dreaming up 3-4 distinct passwords that I rotated in different services. Then I started managing my accounts in an app because I had too many to manually/mentally track. Then it was "use a password manager" and so as I transitioned to the password manager, I had it generate very strong random passwords that I had no hope of remembering, much less typing in manually. So I don't remember any passwords anymore and I couldn't remember them if I tried. I couldn't even type them (although I could transition to a "correct horse battery staple" method instead.) And I'm beholden to my password manager, plus my Yubikeys plus my phone plus my email, due to disparate mandatory MFA challenges. Authentication has become really splintered and really complex. It's ridiculous to insist in this day and age that a password is "something you know" unless it's a master password to unlock your vault or your employer's SSO or something. So that ship has sailed, sorry to inform you!

kingbirdy 4y ago
I don't think you responded to the comment you meant to
knaik94 4y ago
I know all of my passwords, I don't reuse passwords, and I chose from the very beginning to never rely on auto-generated passwords. I would be fine without any kind of password manager. You are making a lot of generalizations about how people interact with passwords. I don't have a single Yubikey, I use Aegis on android that allows me to generate codes and self manage backups of my 2FA secrets. It even supports DUO 2F, but I don't mess with DUO accounts because they are hotp and not totp so you will run into sync issues if your aren't careful. I do have the secret key backed up though. My passwords are something I know. More importantly, even if you use a password manager, your master password is still something you know in the eyes of the law. That covers all passwords that are accessed using a master password as something you know. That's the whole point of multifactor, the second factor is irrelevant without the first. I could surrender all of the 2F secrets and it still wouldn't matter because a password is something I know. Not knowing your passwords is a choice, which you are free to make, I made the opposite choice. I can understand not wanting to remember every password, but it's worth creating self chosen passwords for the critical accounts like google, microsoft, github, and financials, in my opinion. I use biometrics for my mobile OS, but biometrics are only enabled after first unlocking the phone with the pin/password. I use a traditional password for my pc.
- earthling8118 4y ago
  You are not the norm. I would love to know all of my passwords. However when there are nearly 200 of them in the password manager alone this is just not remotely feasible for most people. Not everyone can just memorize that many different unique passwords. That account that I log into once every year? Not a chance I could remember it long term.
  - knaik94 4y ago
    Choosing unique passwords for your main accounts and then relying on the manager for the insignificant accounts is still an option. They're not mutually exclusive. That's not an option if you go the passwordless route.
- illiac786 4y ago
  How many passwords do you have and know?
  - knaik94 4y ago
    Passwords.google counts 577 but I have a seperate set in firefox. Like everyone else that "knows" this many, there's a system. The major accounts don't have a system, I have around 25 accounts with 2F enabled, plus a few financial accounts that all have uniquely created passwords. I absolutely do use a password manager. I don't need to rely on my system, but I will never use the auto-generated passwords.
    - illiac786 4y ago
      But then you are far out of the norm and the fact a generalisation excludes your particular case does not mean it is too generalised, it focusses on the norm simply. Most people struggle to remember a single strong password (I do too). Incidently, having "a system" is one of the things that has been repeatedly advised against, as it weakens your security significantly. I have one too actually (for some accounts), but I recognise I am a/ not the norm at all and b/ definitely not following security best practices. But I estimate (maybe wrongly) that my theat model allows me to take such shortcuts.

kingbirdy 4y ago

I don't think you responded to the comment you meant to

knaik94 4y ago

I know all of my passwords, I don't reuse passwords, and I chose from the very beginning to never rely on auto-generated passwords. I would be fine without any kind of password manager. You are making a lot of generalizations about how people interact with passwords. I don't have a single Yubikey, I use Aegis on android that allows me to generate codes and self manage backups of my 2FA secrets. It even supports DUO 2F, but I don't mess with DUO accounts because they are hotp and not totp so you will run into sync issues if your aren't careful. I do have the secret key backed up though. My passwords are something I know. More importantly, even if you use a password manager, your master password is still something you know in the eyes of the law. That covers all passwords that are accessed using a master password as something you know. That's the whole point of multifactor, the second factor is irrelevant without the first. I could surrender all of the 2F secrets and it still wouldn't matter because a password is something I know. Not knowing your passwords is a choice, which you are free to make, I made the opposite choice. I can understand not wanting to remember every password, but it's worth creating self chosen passwords for the critical accounts like google, microsoft, github, and financials, in my opinion. I use biometrics for my mobile OS, but biometrics are only enabled after first unlocking the phone with the pin/password. I use a traditional password for my pc.

earthling8118 4y ago
You are not the norm. I would love to know all of my passwords. However when there are nearly 200 of them in the password manager alone this is just not remotely feasible for most people. Not everyone can just memorize that many different unique passwords. That account that I log into once every year? Not a chance I could remember it long term.
- knaik94 4y ago
  Choosing unique passwords for your main accounts and then relying on the manager for the insignificant accounts is still an option. They're not mutually exclusive. That's not an option if you go the passwordless route.
illiac786 4y ago
How many passwords do you have and know?
- knaik94 4y ago
  Passwords.google counts 577 but I have a seperate set in firefox. Like everyone else that "knows" this many, there's a system. The major accounts don't have a system, I have around 25 accounts with 2F enabled, plus a few financial accounts that all have uniquely created passwords. I absolutely do use a password manager. I don't need to rely on my system, but I will never use the auto-generated passwords.
  - illiac786 4y ago
    But then you are far out of the norm and the fact a generalisation excludes your particular case does not mean it is too generalised, it focusses on the norm simply. Most people struggle to remember a single strong password (I do too). Incidently, having "a system" is one of the things that has been repeatedly advised against, as it weakens your security significantly. I have one too actually (for some accounts), but I recognise I am a/ not the norm at all and b/ definitely not following security best practices. But I estimate (maybe wrongly) that my theat model allows me to take such shortcuts.