3 ms·

It's time to normalize services generating random passwords for users. Literally a password field with a "Reroll" button. Users shouldn't have to dick around w

It's time to normalize services generating random passwords for users. Literally a password field with a "Reroll" button. Users shouldn't have to dick around with a more complicated 2FA system just to protect themselves from password reuse.

happytoexplain 3y ago
As a security novice, I do wonder if this is more secure overall. It means users will increasingly either use password management tools or they will write it down, digitally and/or physically. So, it defeats password reuse, but the downsides are: 1. Makes it easier for users to lose passwords 2. Makes the user more susceptible to targeted hacking 3. Increases the number of passwords in note-taking services which may themselves be hacked Edit: Also, until a critical threshold is met of adoption among services, some users will just re-use the random password for other services. A lot of this is mitigated by making the password non-human-friendly, essentially forcing users to use password management tools. That could be too much to put on users, until those tools become much more ubiquitous/effortless for the average computer illiterate user (basically the same point you're making about 2FA).
- hombre_fatal 3y ago
  Sure, but all of that is preferable to someone getting pwned across all of their accounts for one of their accounts getting leaked. Though I don't necessarily grant your points. Password reuse means you're susceptible to nontargeted attacks which is strictly worse than your concerns, like #2. i.e. Filtering out weaker attacks doesn't mean you're more susceptible to stronger attacks.
  - happytoexplain 3y ago
    I do agree in that I think individual-targeting attacks are essentially outside the scope of this topic, since you're fucked for a lot more reasons in that scenario, and it's very rare, relatively speaking. I was just listing it to be thorough.
RyanTalbot 3y ago
This is the way, I don’t know any of my passwords bar my master password for my password manager.
onlyrealcuzzo 3y ago
Or you could just use an actual auth provider that does this stuff right.

happytoexplain 3y ago

As a security novice, I do wonder if this is more secure overall. It means users will increasingly either use password management tools or they will write it down, digitally and/or physically. So, it defeats password reuse, but the downsides are: 1. Makes it easier for users to lose passwords 2. Makes the user more susceptible to targeted hacking 3. Increases the number of passwords in note-taking services which may themselves be hacked Edit: Also, until a critical threshold is met of adoption among services, some users will just re-use the random password for other services. A lot of this is mitigated by making the password non-human-friendly, essentially forcing users to use password management tools. That could be too much to put on users, until those tools become much more ubiquitous/effortless for the average computer illiterate user (basically the same point you're making about 2FA).

hombre_fatal 3y ago
Sure, but all of that is preferable to someone getting pwned across all of their accounts for one of their accounts getting leaked. Though I don't necessarily grant your points. Password reuse means you're susceptible to nontargeted attacks which is strictly worse than your concerns, like #2. i.e. Filtering out weaker attacks doesn't mean you're more susceptible to stronger attacks.
- happytoexplain 3y ago
  I do agree in that I think individual-targeting attacks are essentially outside the scope of this topic, since you're fucked for a lot more reasons in that scenario, and it's very rare, relatively speaking. I was just listing it to be thorough.

RyanTalbot 3y ago

This is the way, I don’t know any of my passwords bar my master password for my password manager.

onlyrealcuzzo 3y ago

Or you could just use an actual auth provider that does this stuff right.