5 ms·

I know all of my passwords, I don't reuse passwords, and I chose from the very beginning to never rely on auto-generated passwords. I would be fine without any

I know all of my passwords, I don't reuse passwords, and I chose from the very beginning to never rely on auto-generated passwords. I would be fine without any kind of password manager. You are making a lot of generalizations about how people interact with passwords. I don't have a single Yubikey, I use Aegis on android that allows me to generate codes and self manage backups of my 2FA secrets. It even supports DUO 2F, but I don't mess with DUO accounts because they are hotp and not totp so you will run into sync issues if your aren't careful. I do have the secret key backed up though. My passwords are something I know. More importantly, even if you use a password manager, your master password is still something you know in the eyes of the law. That covers all passwords that are accessed using a master password as something you know. That's the whole point of multifactor, the second factor is irrelevant without the first. I could surrender all of the 2F secrets and it still wouldn't matter because a password is something I know. Not knowing your passwords is a choice, which you are free to make, I made the opposite choice. I can understand not wanting to remember every password, but it's worth creating self chosen passwords for the critical accounts like google, microsoft, github, and financials, in my opinion. I use biometrics for my mobile OS, but biometrics are only enabled after first unlocking the phone with the pin/password. I use a traditional password for my pc.

earthling8118 4y ago
You are not the norm. I would love to know all of my passwords. However when there are nearly 200 of them in the password manager alone this is just not remotely feasible for most people. Not everyone can just memorize that many different unique passwords. That account that I log into once every year? Not a chance I could remember it long term.
- knaik94 4y ago
  Choosing unique passwords for your main accounts and then relying on the manager for the insignificant accounts is still an option. They're not mutually exclusive. That's not an option if you go the passwordless route.
illiac786 4y ago
How many passwords do you have and know?
- knaik94 4y ago
  Passwords.google counts 577 but I have a seperate set in firefox. Like everyone else that "knows" this many, there's a system. The major accounts don't have a system, I have around 25 accounts with 2F enabled, plus a few financial accounts that all have uniquely created passwords. I absolutely do use a password manager. I don't need to rely on my system, but I will never use the auto-generated passwords.
  - illiac786 4y ago
    But then you are far out of the norm and the fact a generalisation excludes your particular case does not mean it is too generalised, it focusses on the norm simply. Most people struggle to remember a single strong password (I do too). Incidently, having "a system" is one of the things that has been repeatedly advised against, as it weakens your security significantly. I have one too actually (for some accounts), but I recognise I am a/ not the norm at all and b/ definitely not following security best practices. But I estimate (maybe wrongly) that my theat model allows me to take such shortcuts.
    - knaik94 4y ago
      My threat model accounts for leaked passwords, even if you are able to identify the system I use, you would have to iterate through ~8! possiblities minimum per account. There's no underlying patterns that allow for shortcuts. There's nothing wrong with a system as long as you can't guess the system by comparing multiple leaked passwords. I don't see how it could weaken security significantly if your system includes randomness in some sense. For example, the order in which you might place words and special characters or the letter placements which you substitute. It's absolutely possible to have a system without weakning security. But that might fundamentally have the same considerations that rolling your own crypto solution would. I was thinking about those very same mistakes when making my system. I expected that a technical crowd like HN would care about stricter privacy, but I continue to be surprised. The threat model I assume is the reason why I would never use passkeys. From the responses I have gotten, my threat model seems stricter than average. Using a manager generated password feels like security through obscurity. As does using a single point of failure piece of hardware where I can't backup the secret. I don't want to use a "virtual" passkey that is attached to a MS or Google or Apple login, especially for replacing passwords. A secret I don't control isn't my secret, similar to the idea of not your keys not your wallet when dealing with cryptocurrency. In this case, there's a very real price of privacy to pay for convenience.

earthling8118 4y ago

You are not the norm. I would love to know all of my passwords. However when there are nearly 200 of them in the password manager alone this is just not remotely feasible for most people. Not everyone can just memorize that many different unique passwords. That account that I log into once every year? Not a chance I could remember it long term.

knaik94 4y ago
Choosing unique passwords for your main accounts and then relying on the manager for the insignificant accounts is still an option. They're not mutually exclusive. That's not an option if you go the passwordless route.

illiac786 4y ago

How many passwords do you have and know?

knaik94 4y ago
Passwords.google counts 577 but I have a seperate set in firefox. Like everyone else that "knows" this many, there's a system. The major accounts don't have a system, I have around 25 accounts with 2F enabled, plus a few financial accounts that all have uniquely created passwords. I absolutely do use a password manager. I don't need to rely on my system, but I will never use the auto-generated passwords.
- illiac786 4y ago
  But then you are far out of the norm and the fact a generalisation excludes your particular case does not mean it is too generalised, it focusses on the norm simply. Most people struggle to remember a single strong password (I do too). Incidently, having "a system" is one of the things that has been repeatedly advised against, as it weakens your security significantly. I have one too actually (for some accounts), but I recognise I am a/ not the norm at all and b/ definitely not following security best practices. But I estimate (maybe wrongly) that my theat model allows me to take such shortcuts.
  - knaik94 4y ago
    My threat model accounts for leaked passwords, even if you are able to identify the system I use, you would have to iterate through ~8! possiblities minimum per account. There's no underlying patterns that allow for shortcuts. There's nothing wrong with a system as long as you can't guess the system by comparing multiple leaked passwords. I don't see how it could weaken security significantly if your system includes randomness in some sense. For example, the order in which you might place words and special characters or the letter placements which you substitute. It's absolutely possible to have a system without weakning security. But that might fundamentally have the same considerations that rolling your own crypto solution would. I was thinking about those very same mistakes when making my system. I expected that a technical crowd like HN would care about stricter privacy, but I continue to be surprised. The threat model I assume is the reason why I would never use passkeys. From the responses I have gotten, my threat model seems stricter than average. Using a manager generated password feels like security through obscurity. As does using a single point of failure piece of hardware where I can't backup the secret. I don't want to use a "virtual" passkey that is attached to a MS or Google or Apple login, especially for replacing passwords. A secret I don't control isn't my secret, similar to the idea of not your keys not your wallet when dealing with cryptocurrency. In this case, there's a very real price of privacy to pay for convenience.