5 ms·
As a security novice, I do wonder if this is more secure overall. It means users will increasingly either use password management tools or they will write it do
by happytoexplain 3y ago
As a security novice, I do wonder if this is more secure overall. It means users will increasingly either use password management tools or they will write it down, digitally and/or physically. So, it defeats password reuse, but the downsides are:
1. Makes it easier for users to lose passwords
2. Makes the user more susceptible to targeted hacking
3. Increases the number of passwords in note-taking services which may themselves be hacked
Edit:
Also, until a critical threshold is met of adoption among services, some users will just re-use the random password for other services.
A lot of this is mitigated by making the password non-human-friendly, essentially forcing users to use password management tools. That could be too much to put on users, until those tools become much more ubiquitous/effortless for the average computer illiterate user (basically the same point you're making about 2FA).
- hombre_fatal 3y agoSure, but all of that is preferable to someone getting pwned across all of their accounts for one of their accounts getting leaked. Though I don't necessarily grant your points. Password reuse means you're susceptible to nontargeted attacks which is strictly worse than your concerns, like #2. i.e. Filtering out weaker attacks doesn't mean you're more susceptible to stronger attacks.
- happytoexplain 3y agoI do agree in that I think individual-targeting attacks are essentially outside the scope of this topic, since you're fucked for a lot more reasons in that scenario, and it's very rare, relatively speaking. I was just listing it to be thorough.