4 ms·

I just use a crappy password. It's been leaked before. I don't care. If someone wants to take over my last.fm account that I haven't used in 3 years, sure go f

by cheeze 3y ago

I just use a crappy password. It's been leaked before. I don't care. If someone wants to take over my last.fm account that I haven't used in 3 years, sure go for it. The important accounts get a randomly generated password stored in my password manager. And the really important accounts only have half the password saved, I manually fill in the other half.

Cannabat 3y ago
I guess that's kinda fine, but there are at least two reasons to not do this: - Access to any of your accounts could make impersonation easier. You might not be the one who suffers from whatever they do. Or if they can assemble enough PII, you might unexpectedly have a line of credit taken out on your name. - Many websites use some form of federated login, or a crossover kinda situation where you have a username/password login that is linked to eg a Google account. Access to the username/password account could open you up to an attack on the juicy targets. Personally, I'd rather none of my accounts are easily compromised, but that's a pipe dream - it's not up to us to secure the services we use. So best thing to do is just use a good password. It's easy these days to use a good password, though I acknowledge still tedious/impossible to update all of your services.
- JohnFen 3y ago
  > Many websites use some form of federated login This one's easy. Don't use federated logins for anything. They're a bad idea.
massysett 3y ago
Why save half the password, versus not saving any of it at all? Is this because the password is very long and you just want to save keystrokes?
- cheeze 3y ago
  Half of the password is randomly generated, the other half is something I add that I can derive easily (think last 5 letters of the website reversed, etc.) That way if my bitwarden gets compromised, attacker still doesn't have my gmail, bank, etc. logins It adds a little bit of security while being mega simple
- WitCanStain 3y ago
  It's a lot easier to remember the second half if you know the first half (if it's a password and not a passcode)

by cheeze 3y ago

Cannabat 3y ago

I guess that's kinda fine, but there are at least two reasons to not do this: - Access to any of your accounts could make impersonation easier. You might not be the one who suffers from whatever they do. Or if they can assemble enough PII, you might unexpectedly have a line of credit taken out on your name. - Many websites use some form of federated login, or a crossover kinda situation where you have a username/password login that is linked to eg a Google account. Access to the username/password account could open you up to an attack on the juicy targets. Personally, I'd rather none of my accounts are easily compromised, but that's a pipe dream - it's not up to us to secure the services we use. So best thing to do is just use a good password. It's easy these days to use a good password, though I acknowledge still tedious/impossible to update all of your services.

JohnFen 3y ago
> Many websites use some form of federated login This one's easy. Don't use federated logins for anything. They're a bad idea.

massysett 3y ago

Why save half the password, versus not saving any of it at all? Is this because the password is very long and you just want to save keystrokes?

cheeze 3y ago
Half of the password is randomly generated, the other half is something I add that I can derive easily (think last 5 letters of the website reversed, etc.) That way if my bitwarden gets compromised, attacker still doesn't have my gmail, bank, etc. logins It adds a little bit of security while being mega simple
WitCanStain 3y ago
It's a lot easier to remember the second half if you know the first half (if it's a password and not a passcode)