4 ms·

Preach. Passwords + password manager are the more secure ideal.

SoftTalker 3y ago
Yes and no. Many online services still have silly rules about password construction and length that preclude the random generated passwords that many password generators create. I often have to remove/substitute disallowed characters or shorten the generated passwords because the service has an arbitrary limit on the length of a password. So yes, they are better but they are still often inconvenient at least when adding a new service.
- aczerepinski 3y ago
  Can’t stand this. I want to challenge the CTO of my bank to a public debate about password best practices.
  - SoftTalker 3y ago
    And a double pox on those sites that disallow "paste" in their passwords fields.
- _kst_ 3y ago
  Blowing my own horn a little, I have a Perl script that generates random passwords, with options to, for example, generate a 16-character password with lowercase letters, but with one uppercase letter, one digit, and one punctuation mark, all chosen randomly and placed at a random position: $ gen-password -len 16 -lower -1upper -1digit -1punct e$hmvcel9nyghAyw Another script in the same project generates XKCD-style random passphrases. https://github.com/Keith-S-Thompson/random-passwords https://github.com/Keith-S-Thompson/random-passwords
lucasyvas 3y ago
I have MFA on for everything and I've about had enough. I'd rather have super non-memorable passwords for everything and have one MFA code for the password manager vault. Passkeys should not require MFA either. I see a good enough future for me and it's: 1. Bitwarden with vault password and MFA 2. Everything else within, passkey I'm completely unconvinced MFA is necessary if the "password manager at top + passkeys for services" mentality is ingrained in everyone. If you offer a service where I sign in with a passkey and also require MFA you better publish an extremely convincing security paper why, or have an infrastructure critical service that burns the world down if someone unauthorized gets in. There is no other justification for that level of security other than to be an asshole.
thesausageking 3y ago
Password manager + MFA is a lot more secure. Password managers aren't impervious to attacks.
autoexec 3y ago
Everything I've seen to replace or "fix" the problems with passwords just makes things worse. My requirements are: 1. Nothing tied to a specific device, especially one that can be easily lost/stolen/broken like a cell phone or USB drive 2. No biometrics 3. It shouldn't permit anyone, outside the website I'm logging into, to know if, when, and/or how often I log into that site. I'm pretty sure using passwords with an offline password manager is the only thing that satisfies that, but if someone comes up with something better that meets all my requirements I'd be all for it.
- Arainach 3y ago
  Other than a few awful providers such as AWS, 2FA isn't limited to a single device. Put it on your cell phone and your old phone you upgraded, or a cheap old phone, or multiple yubikeys, etc. If one is lost you grab a second device.
  - autoexec 3y ago
    yubikeys are interesting, basically not much different than a password manager in the case they get lost/stolen, but I worry about the privacy aspect. I assume using the app, or the use of yubicloud would allow yubico to know which sites I use, and perhaps when.
    - barkingcat 3y ago
      Why would you assume that? You don’t need to use their app.
      - autoexec 3y ago
        It looks like it might be possible to avoid leaking a list of the sites you use with yubikeys, but I need to look closer at how they work on the website's end to make sure they aren't using YubiCloud or some other third party service for validation or key management, and to make sure nothing is trackable through it. It looks like Yubico OTP requires Yubicloud and using yubico-pam might use Yubicloud.
1letterunixname 3y ago
False dichotomy and less secure. Very long passwords + password managers + separate FIDO2 hardware. The point of MFA is that even with a compromised password manager or compromised password, that extra factor is required. The more damaging the loss of credentials would be, the greater the user costs of actual security (more factors) should be allowed to protect them in order to multiply the costs and trouble to potential attackers.

Yes and no. Many online services still have silly rules about password construction and length that preclude the random generated passwords that many password generators create. I often have to remove/substitute disallowed characters or shorten the generated passwords because the service has an arbitrary limit on the length of a password. So yes, they are better but they are still often inconvenient at least when adding a new service.

aczerepinski 3y ago
Can’t stand this. I want to challenge the CTO of my bank to a public debate about password best practices.
- SoftTalker 3y ago
  And a double pox on those sites that disallow "paste" in their passwords fields.
_kst_ 3y ago
Blowing my own horn a little, I have a Perl script that generates random passwords, with options to, for example, generate a 16-character password with lowercase letters, but with one uppercase letter, one digit, and one punctuation mark, all chosen randomly and placed at a random position: $ gen-password -len 16 -lower -1upper -1digit -1punct e$hmvcel9nyghAyw Another script in the same project generates XKCD-style random passphrases. https://github.com/Keith-S-Thompson/random-passwords https://github.com/Keith-S-Thompson/random-passwords

lucasyvas 3y ago

I have MFA on for everything and I've about had enough. I'd rather have super non-memorable passwords for everything and have one MFA code for the password manager vault. Passkeys should not require MFA either. I see a good enough future for me and it's: 1. Bitwarden with vault password and MFA 2. Everything else within, passkey I'm completely unconvinced MFA is necessary if the "password manager at top + passkeys for services" mentality is ingrained in everyone. If you offer a service where I sign in with a passkey and also require MFA you better publish an extremely convincing security paper why, or have an infrastructure critical service that burns the world down if someone unauthorized gets in. There is no other justification for that level of security other than to be an asshole.

thesausageking 3y ago

Password manager + MFA is a lot more secure. Password managers aren't impervious to attacks.

autoexec 3y ago

Everything I've seen to replace or "fix" the problems with passwords just makes things worse. My requirements are: 1. Nothing tied to a specific device, especially one that can be easily lost/stolen/broken like a cell phone or USB drive 2. No biometrics 3. It shouldn't permit anyone, outside the website I'm logging into, to know if, when, and/or how often I log into that site. I'm pretty sure using passwords with an offline password manager is the only thing that satisfies that, but if someone comes up with something better that meets all my requirements I'd be all for it.

Arainach 3y ago
Other than a few awful providers such as AWS, 2FA isn't limited to a single device. Put it on your cell phone and your old phone you upgraded, or a cheap old phone, or multiple yubikeys, etc. If one is lost you grab a second device.
- autoexec 3y ago
  yubikeys are interesting, basically not much different than a password manager in the case they get lost/stolen, but I worry about the privacy aspect. I assume using the app, or the use of yubicloud would allow yubico to know which sites I use, and perhaps when.
  - barkingcat 3y ago
    Why would you assume that? You don’t need to use their app.
    - autoexec 3y ago
      It looks like it might be possible to avoid leaking a list of the sites you use with yubikeys, but I need to look closer at how they work on the website's end to make sure they aren't using YubiCloud or some other third party service for validation or key management, and to make sure nothing is trackable through it. It looks like Yubico OTP requires Yubicloud and using yubico-pam might use Yubicloud.

1letterunixname 3y ago

False dichotomy and less secure. Very long passwords + password managers + separate FIDO2 hardware. The point of MFA is that even with a compromised password manager or compromised password, that extra factor is required. The more damaging the loss of credentials would be, the greater the user costs of actual security (more factors) should be allowed to protect them in order to multiply the costs and trouble to potential attackers.