4 ms·

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multi

I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a rule for which to use for certain types of websites. Like, I really don't get it. Why not just use a password manager. I always tell these people to just sign up for a password manager and they always resist and say no. I must be missing something obvious. Edit: And just as I posted this comment, another bizarre personal strategy for creating passwords: https://news.ycombinator.com/item?id=39335853 https://news.ycombinator.com/item?id=39335853 Just use a password manager! Basically all password managers will generate a random string for a password when you add a new credential. You never even have to look at it or know what it is.

bruce343434 3y ago
A password manager relies on a single point of failure secret (master password), while the website-hash approach relies on a single point of failure secret (master key derivation algorithm). It's really no different, so I think there must be some human biased thinking at play. Except the password manager requires a central or synchronizing computer system, while the in-head key derivation approach requires no such thing. The trade off is that pass mgnrs give more convenience, but have slightly more failure modes (not knowing the master password, not having access to the synchronization or master vault, not wanting to log into a pass mngr on a potentially compromised computer when you only need a single password you are willing to sacrifice) while the in-head approach has a single one: not remembering the derivation method. ETA: both are sensitive to sites changing names or URLs. But password managers more so (requiring extra searching and clicks) while in a mental key derivation context, you would probably remember "oh, it's protonmail." without explicitly needing to distinguish "login.proton.me" from their old URL. But, that does make the key derivation approach slightly more susceptible to phishing. Not seeing the password autofill at least gives mental pause.
- paulmd 3y ago
  Your mental password-generation scheme is equally susceptible to the “master password” being lost or forgotten. Why do you assume you can remember a bunch of rules plus a password, if you can’t remember the password itself? Synchronizing is easy, put it in a network share or Dropbox/google drive/iCloud. If for some reason it’s inaccessible, keepass/dropbox will synchronize any local changes the next time you open the manager while you’re at home. This is a solved problem.
- deleted 3y ago
  [deleted]
- hobs 3y ago
  You missed a few glaring failure modes in the mental model one - one of the most extreme is if someone pops your password on two sites, they can likely derive all your other passwords.
  - throw310822 3y ago
    Sure, although I wonder how often anyone is actually looking at single passwords, rather than just pushing tons of them through automated systems.
    - evilduck 3y ago
      Depends on your threat model. Public figures likely have their passwords individually scrutinized when their accounts are found out.
  - paulryanrogers 3y ago
    I'd go further and point out that derived secret systems put all your future passwords at risk. Whereas a password manager is only your current and past passwords.
- para_parolu 3y ago
  Hash method is prone to websites that rotates passwords, have limits in passwords, have certain rules known passwords. Also, if website database is breached then you may want to create a different password. Plus, username needs to be stored as well sometimes.
Aardwolf 3y ago
For one, a password manager was in the news recently for a data breach, doesn't help the public perception
- autoexec 3y ago
  The best password manager is an offline password manager.
- therealpygon 3y ago
  People in general also tend not to make backups, frequently have computers that get viruses and have to be wiped, and generally just don’t “trust” computers that, in their view, constantly break I think it would be like suggesting people give their life savings to their unreliable neighbor to hold on to. It might be safe, and might be secure, but at the end of the day they are being asked to bet everything on something they don’t find to be reliable. In the end, perception is reality and I can’t say I entirely disagree with the perception. I use a password manager, but unless you are running the infrastructure and backups yourself, which a normal person isn’t going to do, you are at the mercy of “corporations” that we know to make mistakes, have data breaches, lose data, change their policies on a whim, break the law, and even cause people’s deaths, all while suffering few if any consequences. I’d say the average person’s hesitancy toward using a password manager is probably pretty justified, even if it would be far more secure.
serf 3y ago
I use password managers myself, but the 'all my eggs in one basket' dimension is a burden and requires planning.
- mgfist 3y ago
  In the 4 or so years I've been using a password manager I can't remember ever having it feel like a burden or require more planning (besides the upfront work). On the other hand, I can't count how many times it has either saved me or been an incredible convenience. So many random websites require accounts these days (eg. health practitioners) and password managers make it infinitely easier to handle.
crimsons 3y ago
This. I’m so glad I started using one a couple of months back. Just pick a good master password and be done with it.
jstanley 3y ago
> I always tell these people to just sign up for a password manager and they always resist and say no. I must be missing something obvious. Maybe they don't want to be relying on a random third-party for all their passwords? Rather than getting them to sign up for a password manager, what about getting them to install a password manager? I use https://www.passwordstore.org/ https://www.passwordstore.org/ - it encrypts your passwords with GPG, and shares the storage via a Git repository for synchronisation between different machines.
- I_like_pigeons 3y ago
  I suppose the biggest advantage of a online password manager for non-tech savvy users is the syncing between devices.
  - jstanley 3y ago
    But pass does that too, you could even use github for the backing if you wanted.
mpol 3y ago
I was like this some years ago. My assumption was that nobody can guess my password, because it is not straightforward. Untill someone explained that if someone new one password, he would know them all. Only then did I start using Keepassxc. Another factor is inconvenience. On the road, most passwords are out of reach for me now. In a way I prefer it that way, I prefer to not be glued to my phone. As a compromise, there are a few passwords in a note taking app on my phone ;)
- BenjiWiebe 3y ago
  I use VNC over SSH to access my home PC (and it's password manager) from my phone when the need is severe.
DeathArrow 3y ago
>Just use a password manager! What if I don't have access to the password manager at some point but I do need to log into some website? I.e. visiting friends house, forgot my phone at home but I need to log in my banking app to do a transfer? Or visiting a foreign country, someone steals my papers and my phone and I need to login to mail at a public cafe to let my family know I am well.
- williamscales 3y ago
  In the first case most password managers I’m aware of let you log in online. So I’d just log in and use my hardware token on my keyring for 2FA.
- yieldcrv 3y ago
  you can read your passwords in a password manager, memorize a couple of them for the risks you think you have what I typically would do in both of those scenarios is a password reset. I would know my email password and do a password reset of everything else and get that in my email. privilege escalate on yourself. realistically, I’ve been at Apple Stores multiple times where I needed to login manually to my icloud account while my phone was being RMA’d. nothing to remind you there.
  - ianburrell 3y ago
    I think it is important to have a few passwords that have memorized. The most important one for me is Google, cause then can reset passwords with Gmail. I don't store them in password manager.
graypegg 3y ago
I use a password manager, but USED to do that “human hash” of a website. It’s because password managers are annoying at the worst possible times. The dread of “oh god… this device doesn’t support my password manager/im only going to log in once here, so I have to carefully type out random numbers and letters” is not fun. Examples: office zoom meeting room tablet. Standalone VR headset. Smart TV. Trying to share an account for video streaming. (Solved by that being mostly impossible now) The wifi password every single person will ask you for when they’re at your home. That sucks. People immediately imagine those scenarios when you bring it up to them.
- mgfist 3y ago
  One thing you can do is make human readable passwords for sites like Netflix. You can still make it long and save it in the password manager, and it becomes much easier to type out if you need to.
- yieldcrv 3y ago
  How all thats been solved in my world: every service on my TV pops up a big QR code for your second device (a phone) to access and log in with iphones prompt you to share the password when your iphone using friend tries to connect to a wifi network you are on Regarding VR, hm knowing an Apple Vision Pro will be connected to my icloud account makes me know I wont have to do that stuff. Other standalone headsets I wonder how or if they solve that problem. My Playstation VR headset dual renders on screen so the qr code solution is already there.
k8svet 3y ago
It's like people way to into conspiracy theories. They want to seem smart. I never don't have my phone. I've been aggressively using a password manager for nearly s decade and it's never once been an issue.
- noman-land 3y ago
  I dropped my phone at night in a foreign country and the screen went blank. I couldn't get into anything, not even my hotel.
  - k8svet 3y ago
    Yeah, I amended my thoughts reading the thread. I left out a pretty important detail. I do have one, other, high entropy password that is memorized for my Google account. I don't use social login, but Google = Gmail = everything. So yes, I was too dismissive. Given the nature of "security", I think it's impossible to have a silver bullet of secure + easy.
littlestymaar 3y ago
Using a password manager means your password are handled by someone else's code and you need to trust them not to fuck up. Also, they are really juicy targets. Also, here's why people don't want to use a password manager: https://arstechnica.com/information-technology/2023/02/lastpass-hackers-infected-employees-home-computer-and-stole-corporate-vault/ https://arstechnica.com/information-technology/2023/02/lastp...
doix 3y ago
And one day your managed password manager will get hacked and some smug user on HN will tell you how you should have self hosted it ;). Or you'll get locked out of all your accounts one day. Let's not pretend like password managers are a silver bullet.
- hobs 3y ago
  They are a lot more powerful of a bullet than just ... nothing at all! (and I self host my password manager because of course you should)
- yieldcrv 3y ago
  I agree with self hosting. I hate that they went to the cloud I will sync via icloud or another encrypted backup at my discretion But everything convenient did something dumb
temporarara 3y ago
No. I will never put all my passwords into some black box, no matter how it is pitched to me, and certainly I won't pay for that "privilege". I have all my passwords written down in a sheet of paper slightly obfuscated to make them pretty much worthless even if someone found them (actually I have multiple copies, stored in multiple places). They are all mnemonic to begin with. So if my computer dies, for example, my life continues just like before. I don't have "real" social media accounts to begin with, so my life won't be ruined even if someone cracked all my passwords. Mostly it's just accounts for various online shops I've used during the years. I really don't care if someone hacks those. And access to my bank is pretty much worthless if you don't have my phone and the pin code sheet too. Well I don't have big money in bank anyway, so the crime doesn't pay well in any case.
- paulmd 3y ago
  wow I never knew pass(1) cost money, how does that work? isn’t it GPL and all???? (keepass2/keepass xc are more user-friendly and free, strongbox is another good front-end for keepass files as well.)
- CharlesW 3y ago
  > I will never put all my passwords into some black box […]. I have all my passwords written down in a sheet of paper slightly obfuscated to make them pretty much worthless even if someone found them (actually I have multiple copies, stored in multiple places). Is this satire?
  - ifyoubuildit 3y ago
    Well, his sheets of paper could be obtained by 10s to 100s of people with physical access who then might figure out the obfuscation (or burn down in a fire, but copies mitigate that). Some fancy password manager service can be attacked by anyone with a network connection or the budget to buy the company. And there's an actual incentive to attack the password service because it doesn't just have parent's passwords, it has many passwords. I think the only downside to the sheet of paper is that people with physical access are probably more likely to be specifically interested in you, and therefore willing to put in the effort to figure it out. But they'd probably figure it out anyway if they're that interested (install a keylogger or camera or something).
DisgracePlacard 3y ago
If the endgame of passwords is for everyone to use password managers for their passwords, and never to actually learn their passwords, then why bother with passwords at all? It seems to endgame would be for every service to give up passwords, and switch to OTP codes entirely. I'd prefer that world, honestly. Yet I haven't seen many people talk about the possibility, so maybe I'm missing something obvious? I don't know.
- CharlesW 3y ago
  > If the endgame of passwords is for everyone to use password managers for their passwords, and never to actually learn their passwords, then why bother with passwords at all? Exactly, they'll be a memory in 10 years. https://fidoalliance.org/passkeys/ https://fidoalliance.org/passkeys/
chrisnight 3y ago
> Like, I really don't get it. Why not just use a password manager. I always tell these people to just sign up for a password manager and they always resist and say no. I must be missing something obvious. Simple, I don’t trust a cloud service to keep the data secure, and I don’t trust myself to self host and keep the data safe (and not get corrupted) while simultaneously getting that data on all devices and synced. The flaw of password managers is that you don’t know the passwords you’re using for your sites. That is, if the data was lost, you’d have to do an account recovery, which for some sites is fine, for others it can be a nightmare though. Alongside this, it is a hard problem to have to simultaneously get all of these copied-pasted passwords on each device without inherently putting them on the Internet (albeit with a password in front of them). Given a threat model of password managers being inherently valuable targets, data going in and out of them is inherently vulnerable for when an exploit is inevitably found. I’m not saying any of these problems makes mental hash algorithms or rotating passwords better, but password managers do have inherent flaws that make them still an unideal tool. Also, I find it ironic in the modern day that a simple sticky note next to your computer is probably one of the better solutions to password management, if people invading your physical space isn’t part of your threat model (which is usually the case).
- CharlesW 3y ago
  > The flaw of password managers is that you don’t know the passwords you’re using for your sites. That is, if the data was lost, you’d have to do an account recovery, which for some sites is fine, for others it can be a nightmare though. It's typically a 5-minute process, which I know because services regularly force password resets quite often. > …I don’t trust a cloud service to keep the data secure. Fair enough, there are definitely shady SaaS vendors. My password manager is a SaaS with a long history (2006), which has no access to my account passwords or Secret Keys and could not reset or recover them for me if I asked. I'm personally satisfied with that. Have you considered the benefits? For example, I know I currently have 1,161 account logins on various sites/services, 278 of which have "fantastic" passwords, and 144 which have "fair" passwords that I should really go back and update (surely from my pre-password-manager days). I know there are 5 accounts that now support 2FA, and many more which now support passkeys. I know when I've last used each so I can easily close old accounts, which I gradually do. That kind of awareness/security hygiene enablement would be tough (if not impossible) to replicate manually.

bruce343434 3y ago

A password manager relies on a single point of failure secret (master password), while the website-hash approach relies on a single point of failure secret (master key derivation algorithm). It's really no different, so I think there must be some human biased thinking at play. Except the password manager requires a central or synchronizing computer system, while the in-head key derivation approach requires no such thing. The trade off is that pass mgnrs give more convenience, but have slightly more failure modes (not knowing the master password, not having access to the synchronization or master vault, not wanting to log into a pass mngr on a potentially compromised computer when you only need a single password you are willing to sacrifice) while the in-head approach has a single one: not remembering the derivation method. ETA: both are sensitive to sites changing names or URLs. But password managers more so (requiring extra searching and clicks) while in a mental key derivation context, you would probably remember "oh, it's protonmail." without explicitly needing to distinguish "login.proton.me" from their old URL. But, that does make the key derivation approach slightly more susceptible to phishing. Not seeing the password autofill at least gives mental pause.

paulmd 3y ago
Your mental password-generation scheme is equally susceptible to the “master password” being lost or forgotten. Why do you assume you can remember a bunch of rules plus a password, if you can’t remember the password itself? Synchronizing is easy, put it in a network share or Dropbox/google drive/iCloud. If for some reason it’s inaccessible, keepass/dropbox will synchronize any local changes the next time you open the manager while you’re at home. This is a solved problem.
deleted 3y ago
[deleted]
hobs 3y ago
You missed a few glaring failure modes in the mental model one - one of the most extreme is if someone pops your password on two sites, they can likely derive all your other passwords.
- throw310822 3y ago
  Sure, although I wonder how often anyone is actually looking at single passwords, rather than just pushing tons of them through automated systems.
  - evilduck 3y ago
    Depends on your threat model. Public figures likely have their passwords individually scrutinized when their accounts are found out.
- paulryanrogers 3y ago
  I'd go further and point out that derived secret systems put all your future passwords at risk. Whereas a password manager is only your current and past passwords.
para_parolu 3y ago
Hash method is prone to websites that rotates passwords, have limits in passwords, have certain rules known passwords. Also, if website database is breached then you may want to create a different password. Plus, username needs to be stored as well sometimes.

Aardwolf 3y ago

For one, a password manager was in the news recently for a data breach, doesn't help the public perception

autoexec 3y ago
The best password manager is an offline password manager.
therealpygon 3y ago
People in general also tend not to make backups, frequently have computers that get viruses and have to be wiped, and generally just don’t “trust” computers that, in their view, constantly break I think it would be like suggesting people give their life savings to their unreliable neighbor to hold on to. It might be safe, and might be secure, but at the end of the day they are being asked to bet everything on something they don’t find to be reliable. In the end, perception is reality and I can’t say I entirely disagree with the perception. I use a password manager, but unless you are running the infrastructure and backups yourself, which a normal person isn’t going to do, you are at the mercy of “corporations” that we know to make mistakes, have data breaches, lose data, change their policies on a whim, break the law, and even cause people’s deaths, all while suffering few if any consequences. I’d say the average person’s hesitancy toward using a password manager is probably pretty justified, even if it would be far more secure.

serf 3y ago

I use password managers myself, but the 'all my eggs in one basket' dimension is a burden and requires planning.

mgfist 3y ago
In the 4 or so years I've been using a password manager I can't remember ever having it feel like a burden or require more planning (besides the upfront work). On the other hand, I can't count how many times it has either saved me or been an incredible convenience. So many random websites require accounts these days (eg. health practitioners) and password managers make it infinitely easier to handle.

crimsons 3y ago

This. I’m so glad I started using one a couple of months back. Just pick a good master password and be done with it.

jstanley 3y ago

> I always tell these people to just sign up for a password manager and they always resist and say no. I must be missing something obvious. Maybe they don't want to be relying on a random third-party for all their passwords? Rather than getting them to sign up for a password manager, what about getting them to install a password manager? I use https://www.passwordstore.org/ https://www.passwordstore.org/ - it encrypts your passwords with GPG, and shares the storage via a Git repository for synchronisation between different machines.

I_like_pigeons 3y ago
I suppose the biggest advantage of a online password manager for non-tech savvy users is the syncing between devices.
- jstanley 3y ago
  But pass does that too, you could even use github for the backing if you wanted.

mpol 3y ago

I was like this some years ago. My assumption was that nobody can guess my password, because it is not straightforward. Untill someone explained that if someone new one password, he would know them all. Only then did I start using Keepassxc. Another factor is inconvenience. On the road, most passwords are out of reach for me now. In a way I prefer it that way, I prefer to not be glued to my phone. As a compromise, there are a few passwords in a note taking app on my phone ;)

BenjiWiebe 3y ago
I use VNC over SSH to access my home PC (and it's password manager) from my phone when the need is severe.

DeathArrow 3y ago

>Just use a password manager! What if I don't have access to the password manager at some point but I do need to log into some website? I.e. visiting friends house, forgot my phone at home but I need to log in my banking app to do a transfer? Or visiting a foreign country, someone steals my papers and my phone and I need to login to mail at a public cafe to let my family know I am well.

williamscales 3y ago
In the first case most password managers I’m aware of let you log in online. So I’d just log in and use my hardware token on my keyring for 2FA.
yieldcrv 3y ago
you can read your passwords in a password manager, memorize a couple of them for the risks you think you have what I typically would do in both of those scenarios is a password reset. I would know my email password and do a password reset of everything else and get that in my email. privilege escalate on yourself. realistically, I’ve been at Apple Stores multiple times where I needed to login manually to my icloud account while my phone was being RMA’d. nothing to remind you there.
- ianburrell 3y ago
  I think it is important to have a few passwords that have memorized. The most important one for me is Google, cause then can reset passwords with Gmail. I don't store them in password manager.

graypegg 3y ago

I use a password manager, but USED to do that “human hash” of a website. It’s because password managers are annoying at the worst possible times. The dread of “oh god… this device doesn’t support my password manager/im only going to log in once here, so I have to carefully type out random numbers and letters” is not fun. Examples: office zoom meeting room tablet. Standalone VR headset. Smart TV. Trying to share an account for video streaming. (Solved by that being mostly impossible now) The wifi password every single person will ask you for when they’re at your home. That sucks. People immediately imagine those scenarios when you bring it up to them.

mgfist 3y ago
One thing you can do is make human readable passwords for sites like Netflix. You can still make it long and save it in the password manager, and it becomes much easier to type out if you need to.
yieldcrv 3y ago
How all thats been solved in my world: every service on my TV pops up a big QR code for your second device (a phone) to access and log in with iphones prompt you to share the password when your iphone using friend tries to connect to a wifi network you are on Regarding VR, hm knowing an Apple Vision Pro will be connected to my icloud account makes me know I wont have to do that stuff. Other standalone headsets I wonder how or if they solve that problem. My Playstation VR headset dual renders on screen so the qr code solution is already there.

k8svet 3y ago

It's like people way to into conspiracy theories. They want to seem smart. I never don't have my phone. I've been aggressively using a password manager for nearly s decade and it's never once been an issue.

noman-land 3y ago
I dropped my phone at night in a foreign country and the screen went blank. I couldn't get into anything, not even my hotel.
- k8svet 3y ago
  Yeah, I amended my thoughts reading the thread. I left out a pretty important detail. I do have one, other, high entropy password that is memorized for my Google account. I don't use social login, but Google = Gmail = everything. So yes, I was too dismissive. Given the nature of "security", I think it's impossible to have a silver bullet of secure + easy.

littlestymaar 3y ago

Using a password manager means your password are handled by someone else's code and you need to trust them not to fuck up. Also, they are really juicy targets. Also, here's why people don't want to use a password manager: https://arstechnica.com/information-technology/2023/02/lastpass-hackers-infected-employees-home-computer-and-stole-corporate-vault/ https://arstechnica.com/information-technology/2023/02/lastp...

doix 3y ago

And one day your managed password manager will get hacked and some smug user on HN will tell you how you should have self hosted it ;). Or you'll get locked out of all your accounts one day. Let's not pretend like password managers are a silver bullet.

hobs 3y ago
They are a lot more powerful of a bullet than just ... nothing at all! (and I self host my password manager because of course you should)
yieldcrv 3y ago
I agree with self hosting. I hate that they went to the cloud I will sync via icloud or another encrypted backup at my discretion But everything convenient did something dumb

temporarara 3y ago

No. I will never put all my passwords into some black box, no matter how it is pitched to me, and certainly I won't pay for that "privilege". I have all my passwords written down in a sheet of paper slightly obfuscated to make them pretty much worthless even if someone found them (actually I have multiple copies, stored in multiple places). They are all mnemonic to begin with. So if my computer dies, for example, my life continues just like before. I don't have "real" social media accounts to begin with, so my life won't be ruined even if someone cracked all my passwords. Mostly it's just accounts for various online shops I've used during the years. I really don't care if someone hacks those. And access to my bank is pretty much worthless if you don't have my phone and the pin code sheet too. Well I don't have big money in bank anyway, so the crime doesn't pay well in any case.

paulmd 3y ago
wow I never knew pass(1) cost money, how does that work? isn’t it GPL and all???? (keepass2/keepass xc are more user-friendly and free, strongbox is another good front-end for keepass files as well.)
CharlesW 3y ago
> I will never put all my passwords into some black box […]. I have all my passwords written down in a sheet of paper slightly obfuscated to make them pretty much worthless even if someone found them (actually I have multiple copies, stored in multiple places). Is this satire?
- ifyoubuildit 3y ago
  Well, his sheets of paper could be obtained by 10s to 100s of people with physical access who then might figure out the obfuscation (or burn down in a fire, but copies mitigate that). Some fancy password manager service can be attacked by anyone with a network connection or the budget to buy the company. And there's an actual incentive to attack the password service because it doesn't just have parent's passwords, it has many passwords. I think the only downside to the sheet of paper is that people with physical access are probably more likely to be specifically interested in you, and therefore willing to put in the effort to figure it out. But they'd probably figure it out anyway if they're that interested (install a keylogger or camera or something).

DisgracePlacard 3y ago

If the endgame of passwords is for everyone to use password managers for their passwords, and never to actually learn their passwords, then why bother with passwords at all? It seems to endgame would be for every service to give up passwords, and switch to OTP codes entirely. I'd prefer that world, honestly. Yet I haven't seen many people talk about the possibility, so maybe I'm missing something obvious? I don't know.

CharlesW 3y ago
> If the endgame of passwords is for everyone to use password managers for their passwords, and never to actually learn their passwords, then why bother with passwords at all? Exactly, they'll be a memory in 10 years. https://fidoalliance.org/passkeys/ https://fidoalliance.org/passkeys/

chrisnight 3y ago

> Like, I really don't get it. Why not just use a password manager. I always tell these people to just sign up for a password manager and they always resist and say no. I must be missing something obvious. Simple, I don’t trust a cloud service to keep the data secure, and I don’t trust myself to self host and keep the data safe (and not get corrupted) while simultaneously getting that data on all devices and synced. The flaw of password managers is that you don’t know the passwords you’re using for your sites. That is, if the data was lost, you’d have to do an account recovery, which for some sites is fine, for others it can be a nightmare though. Alongside this, it is a hard problem to have to simultaneously get all of these copied-pasted passwords on each device without inherently putting them on the Internet (albeit with a password in front of them). Given a threat model of password managers being inherently valuable targets, data going in and out of them is inherently vulnerable for when an exploit is inevitably found. I’m not saying any of these problems makes mental hash algorithms or rotating passwords better, but password managers do have inherent flaws that make them still an unideal tool. Also, I find it ironic in the modern day that a simple sticky note next to your computer is probably one of the better solutions to password management, if people invading your physical space isn’t part of your threat model (which is usually the case).

CharlesW 3y ago
> The flaw of password managers is that you don’t know the passwords you’re using for your sites. That is, if the data was lost, you’d have to do an account recovery, which for some sites is fine, for others it can be a nightmare though. It's typically a 5-minute process, which I know because services regularly force password resets quite often. > …I don’t trust a cloud service to keep the data secure. Fair enough, there are definitely shady SaaS vendors. My password manager is a SaaS with a long history (2006), which has no access to my account passwords or Secret Keys and could not reset or recover them for me if I asked. I'm personally satisfied with that. Have you considered the benefits? For example, I know I currently have 1,161 account logins on various sites/services, 278 of which have "fantastic" passwords, and 144 which have "fair" passwords that I should really go back and update (surely from my pre-password-manager days). I know there are 5 accounts that now support 2FA, and many more which now support passkeys. I know when I've last used each so I can easily close old accounts, which I gradually do. That kind of awareness/security hygiene enablement would be tough (if not impossible) to replicate manually.