3 ms·

What if one loses all their devices in a natural disaster, a house fire, or burglary, or lost baggage while traveling? A password is in your head. If you lose

by clnq 3y ago

What if one loses all their devices in a natural disaster, a house fire, or burglary, or lost baggage while traveling? A password is in your head. If you lose that, there's not much use for the said password. But otherwise, it's secure. And it's pretty secure from an infosec perspective if it's a passphrase.

ChancyChance 3y ago
1Password literally asks you to print out your private key. Yet their hygiene is lauded.
skybrian 3y ago
I think it's more likely that you'll lose your password by forgetting it? People forget many things without losing their heads. There's no perfect solution. Having a printout of backup codes in a fireproof safe is pretty good, but it's of no use while traveling. A Yubikey is good, but it might not work (wrong USB port) and it's a device that could break. Having multiple ways to log in reduces your risk of lockout, but also makes it more likely that someone unauthorized could get access.
- clnq 3y ago
  Passwords, particularly passphrases, are easy to remember and you can reuse a similar structure for probably decades: - There-are-three-ducklings3-in-the-lake - There-are-five-swans5-in-the-lake - There-are-six-hedgehogs6-in-the-bush And so on. You only need to remember the latest number and animal, but the entropy of the whole string is much higher unless someone also knows your personal password structure (which is kind of like a second factor). With a password manager, you only need to remember that one passphrase. If you have to enter it daily, I think it’s very difficult to forget. You can access your passwords mostly independently from any device and it’s probably about as secure if good generated password hygiene on websites and services is used.
  - skybrian 3y ago
    Well okay, but now you depend on a password manager. Hope you picked the right one and backed it up? I’m not sure this is better than using a device to log in.
    - clnq 3y ago
      You are right, choosing the right one (reading its whitepaper and what encryption it uses where), and backups are very important for those. I suppose logging into all of the services we use these days is complicated and not very secure no matter the method.

by clnq 3y ago

ChancyChance 3y ago

1Password literally asks you to print out your private key. Yet their hygiene is lauded.

skybrian 3y ago

I think it's more likely that you'll lose your password by forgetting it? People forget many things without losing their heads. There's no perfect solution. Having a printout of backup codes in a fireproof safe is pretty good, but it's of no use while traveling. A Yubikey is good, but it might not work (wrong USB port) and it's a device that could break. Having multiple ways to log in reduces your risk of lockout, but also makes it more likely that someone unauthorized could get access.

clnq 3y ago
Passwords, particularly passphrases, are easy to remember and you can reuse a similar structure for probably decades: - There-are-three-ducklings3-in-the-lake - There-are-five-swans5-in-the-lake - There-are-six-hedgehogs6-in-the-bush And so on. You only need to remember the latest number and animal, but the entropy of the whole string is much higher unless someone also knows your personal password structure (which is kind of like a second factor). With a password manager, you only need to remember that one passphrase. If you have to enter it daily, I think it’s very difficult to forget. You can access your passwords mostly independently from any device and it’s probably about as secure if good generated password hygiene on websites and services is used.
- skybrian 3y ago
  Well okay, but now you depend on a password manager. Hope you picked the right one and backed it up? I’m not sure this is better than using a device to log in.
  - clnq 3y ago
    You are right, choosing the right one (reading its whitepaper and what encryption it uses where), and backups are very important for those. I suppose logging into all of the services we use these days is complicated and not very secure no matter the method.