5 ms·
Clever is fine, if long enough, but it doesn't scale. The problem is not that i need a clever password, it's that I need 100 of them. Given that problem I eith
by bruce511 3y ago
Clever is fine, if long enough, but it doesn't scale.
The problem is not that i need a clever password, it's that I need 100 of them. Given that problem I either reuse my clever one everywhere, or have a formula based on it, and the domain.
In this age of scale, a password manager generating long random passwords is not "good to do", it's absolutely a requirement.
Now all you need is one long, clever, resilient password to access the password manager.
- kevin_thibedeau 3y ago> In this age of scale, a password manager generating long random passwords is not "good to do", it's absolutely a requirement. One day there will be an exploit for your password manager.
- Dylan16807 3y agoAny computer can get infected with a password stealer. As long as the password manager isn't significantly increasing the risk, then there's no problem.
- ryandrake 3y agoAll my passwords are “password” and I just use 2 factor auth for security.
- bawolff 3y agoThis is pretty risky given how lax sone places are with allowing customer service to be talked into removing 2fa.
- 8organicbits 3y agoI've seen platforms that don't rate limit 2fa guesses. A six digit OTP has only a million possible values. Guessing once per second it only takes a couple days to guess. This is also why a platform should never confirm that a password is correct when 2FA is enabled, only confirm if both have been solved.
- pintxo 3y ago2FA is usually time limited? So this seems not to be an issue?
- rhysmdnz 3y agoBecause of fun probability stuff. The fact what your guessing changes doesn’t matter. It’s still a day to get a correct guess. https://pulsesecurity.co.nz/articles/totp-bruting https://pulsesecurity.co.nz/articles/totp-bruting
- 8organicbits 3y agoThink about a time-based one-time passcode (OTP). Every 30 seconds you get a fresh code and the attacker tries to guess that code. There's usually a validity window of one or more OTP, so the attacker needs to guess one of several possible currently valid OTP. This is a popular trick in CTF exercises and it's pretty quick if you can make 1000 guesses per second. Takes a couple minutes until you're in.
- bawolff 3y agoThere are various design decisions that password managers can do to reduce this risk. However there is always risk, the question is - is it better than the alternative? For most reasonably designed password managers the answer is yes. Heck for the average person, a sticky note on the monitor is probably better than the alternative.
- Measter 3y agoOf course, but that still requires the attacker to specifically target me. Attacking some random service I have an account with and getting everyone's account info isn't enough.
- ThePowerOfFuet 3y agoThis isn't the case; look up "credential spraying".
- throawayonthe 3y ago[dead]
- lolinder 3y agoDo you mean password spraying? Or credential stuffing? Or something different entirely?
- raverbashing 3y agoAnd even if you use a clever password you might be giving it to someone who has never heard of password hashing/salting etc (but I'm sure they "care about your privacy") Hence why I prefer "not great/not bad" passwords to sites that wouldn't have a significant impact on my privacy
- lolinder 3y agoWhy not use a password manager? You're just taking on risk by subjectively evaluating which sites can be trusted with a clever password.
- raverbashing 3y agoI do use one. Doesn't mean that I want all my passwords to be an annoyingly long sequence of random letters and symbols