6 ms·

I’ve been preaching this message for many years now. For example, since password generators basically make keys that can’t be remembered, this has led to the ad

I’ve been preaching this message for many years now. For example, since password generators basically make keys that can’t be remembered, this has led to the advent of password managers, all protected by a single password, so your single point of failure is now just ONE password, the consequences of which would be that an attacker would have access to all of your passwords. The n-tries lockout rule is much more effective anyway, as it breaks the brute-force attack vector in most cases. I am not a cybersecurity expert, so perhaps there are cases where high-complexity, long passwords may make a difference. Not to mention MFA makes most of this moot anyway.

nouveaux 2y ago
Most of us can't remember more than one password. This means that if one site is compromised, then the attacker now has access to multiple sites. A password manager mitigates this issue.
- userbinator 2y ago
  Vary the password per site based on your own algorithm.
  - jay_kyburz 2y ago
    AKA, put the name of the site in the password :)
    - userbinator 2y ago
      Not necessarily, but just a pattern that only you would likely remember.
      - viraptor 2y ago
        You need a pattern that only you recognise/understand, not just remember. It takes only one leak of your password from service FooBar that looks like "f....b" to know what to try on other sites. Patterns easy to remember are mostly easy to understand.
      - ArnoVW 2y ago
        With LLM that sort of approach can be attacked at scale
    - Sohcahtoa82 2y ago
      "MyPasswordIsSecureDespiteNotBeingComplexBecauseItIsLong_BobsForum" is great until Bob's Forum gets hacked and it turns out that they were storing your password in plain text and your password of "MyPasswordIsSecureDespiteNotBeingComplexBecauseItIsLong_Google" becomes easily guessed.
      - zzo38computer 2y ago
        One way to mitigate such a problem is to use the hash of this text as the password, instead of using the text directly.
  - tshaddox 2y ago
    That algorithm becomes analogous to the password to your password manager.
- cardanome 2y ago
  People used to memorize the phone numbers of all important family members and close friends without much trouble. Anyone without a serious disability should have no trouble memorizing multiple passwords. Sure, I do use password managers for random sites and services but I probably have at lower double digit amount of passwords memorized for the stuff that matters. Especially for stuff that I want to be able to access in an emergency when my phone/laptop gets stolen.
  - watwut 2y ago
    They did not. They had papers with all those numbers written down next to landline phones. They also had little notebooks they carried everywhere with them with those numbers written down. You could buy those little notebooks in any store and they fitted into a pocket. Moreover, those numbers did not changed for years and years. Unlike passwords that change, like, every 3 months.
  - 542354234235 2y ago
    People used to memorize a few phone numbers, likely less than 10, and used notebooks made specifically for writing down phone numbers to keep track of the rest. Phone numbers of the people you called the most (the 10 you memorized) were overwhelmingly likely to be local numbers, so you were only memorizing (3 number chunk) + (4 number chunk). Password rules are all over the place. Memorizing numbers, letters, whole words, the capitalization of those letters and words, and special characters, that are far longer than ye olde timey phone numbers, is orders of magnitude more difficult. I have over 100 passwords in my password manager. They are all unique, so if any one is compromised, it is contained. My password manager is protected by strong 2FA, so someone would have to physically interact with my property to gain access. In the real world, there is no scenario where memorizing all your passwords is more secure.
- soupbowl 2y ago
  Most people can surely remember beyond one password.
  - defrost 2y ago
    Not to mention they're like underpants, you can use the same one forwards, backwards, inside out, and inside out backwards.
  - chipsrafferty 2y ago
    Surely not more than 1 or 2
  - bende511 2y ago
    They can remember O(1) passwords, but they need O(n) passwords
borski 2y ago
> so your single point of failure is now just ONE password, the consequences of which would be that an attacker would have access to all of your passwords. Most managers have 2FA, or an offline key, to prevent this issue, and encrypt your passwords at rest so that without that key (and the password) the database is useless.
- nottorp 2y ago
  > and encrypt your passwords at rest I haven't turned off my desktop this year. How does encryption at rest help?
  - doubled112 2y ago
    My password manager locks when I lock my screen. You can configure it to lock after some time. The database is encrypted at rest.
    - necovek 2y ago
      Locking is not sufficient: it would need to overwrite the memory where passwords were decrypted to. With virtual memory, this becomes harder.
      - compootr 2y ago
        What's sufficient depends on your threat model. Normal dude in a secure office? An auto-locking password manager would suffice. Someone that should be concerned with passwords in-memory is someone who believes another has full physical access to their computer (and can, say, freeze RAM in nitrogen to extract passwords My largest concern would be an adversary snatching my phone while my password manager was actively opened
        necovek 2y ago
        Locking a password manager and your computer is certainly good enough in many cases. But gaining access to memory might not need the sophistication of using nitrogen (see eg https://en.m.wikipedia.org/wiki/DMA_attack https://en.m.wikipedia.org/wiki/DMA_attack).
unethical_ban 2y ago
The one password and the app that uses it are more secure than most other applications. Lock out is just another term for DDoS if a bad actor knows usernames. I love proton pass.
wruza 2y ago
My bitwarden plugin locks out after a few minutes of inactivity. New installations are protected by totp. So one has to physically be at one of my devices few minutes after I leave even if they have a password. This reduces the attack source to a few people that I have to trust anyway. Also I can lock / logout manually if situation suggests. Or not log in at all and instead type the password from my phone screen. I understand the conceptual risk of storing everything behind a single “door”. That’s not ideal. But in practice, circumstances force you to create passwords, expose passwords, reset passwords, so you cannot remember them all. You either write them down (where? how secure?) or resort to having only a few “that you usually use”. Password managers solve the “where? how secure?” part. They don’t solve security, they help you to not do stupid things under pressure.

nouveaux 2y ago

Most of us can't remember more than one password. This means that if one site is compromised, then the attacker now has access to multiple sites. A password manager mitigates this issue.

userbinator 2y ago
Vary the password per site based on your own algorithm.
- jay_kyburz 2y ago
  AKA, put the name of the site in the password :)
  - userbinator 2y ago
    Not necessarily, but just a pattern that only you would likely remember.
    - viraptor 2y ago
      You need a pattern that only you recognise/understand, not just remember. It takes only one leak of your password from service FooBar that looks like "f....b" to know what to try on other sites. Patterns easy to remember are mostly easy to understand.
    - ArnoVW 2y ago
      With LLM that sort of approach can be attacked at scale
  - Sohcahtoa82 2y ago
    "MyPasswordIsSecureDespiteNotBeingComplexBecauseItIsLong_BobsForum" is great until Bob's Forum gets hacked and it turns out that they were storing your password in plain text and your password of "MyPasswordIsSecureDespiteNotBeingComplexBecauseItIsLong_Google" becomes easily guessed.
    - zzo38computer 2y ago
      One way to mitigate such a problem is to use the hash of this text as the password, instead of using the text directly.
- tshaddox 2y ago
  That algorithm becomes analogous to the password to your password manager.
cardanome 2y ago
People used to memorize the phone numbers of all important family members and close friends without much trouble. Anyone without a serious disability should have no trouble memorizing multiple passwords. Sure, I do use password managers for random sites and services but I probably have at lower double digit amount of passwords memorized for the stuff that matters. Especially for stuff that I want to be able to access in an emergency when my phone/laptop gets stolen.
- watwut 2y ago
  They did not. They had papers with all those numbers written down next to landline phones. They also had little notebooks they carried everywhere with them with those numbers written down. You could buy those little notebooks in any store and they fitted into a pocket. Moreover, those numbers did not changed for years and years. Unlike passwords that change, like, every 3 months.
- 542354234235 2y ago
  People used to memorize a few phone numbers, likely less than 10, and used notebooks made specifically for writing down phone numbers to keep track of the rest. Phone numbers of the people you called the most (the 10 you memorized) were overwhelmingly likely to be local numbers, so you were only memorizing (3 number chunk) + (4 number chunk). Password rules are all over the place. Memorizing numbers, letters, whole words, the capitalization of those letters and words, and special characters, that are far longer than ye olde timey phone numbers, is orders of magnitude more difficult. I have over 100 passwords in my password manager. They are all unique, so if any one is compromised, it is contained. My password manager is protected by strong 2FA, so someone would have to physically interact with my property to gain access. In the real world, there is no scenario where memorizing all your passwords is more secure.
soupbowl 2y ago
Most people can surely remember beyond one password.
- defrost 2y ago
  Not to mention they're like underpants, you can use the same one forwards, backwards, inside out, and inside out backwards.
- chipsrafferty 2y ago
  Surely not more than 1 or 2
- bende511 2y ago
  They can remember O(1) passwords, but they need O(n) passwords

borski 2y ago

> so your single point of failure is now just ONE password, the consequences of which would be that an attacker would have access to all of your passwords. Most managers have 2FA, or an offline key, to prevent this issue, and encrypt your passwords at rest so that without that key (and the password) the database is useless.

nottorp 2y ago
> and encrypt your passwords at rest I haven't turned off my desktop this year. How does encryption at rest help?
- doubled112 2y ago
  My password manager locks when I lock my screen. You can configure it to lock after some time. The database is encrypted at rest.
  - necovek 2y ago
    Locking is not sufficient: it would need to overwrite the memory where passwords were decrypted to. With virtual memory, this becomes harder.
    - compootr 2y ago
      What's sufficient depends on your threat model. Normal dude in a secure office? An auto-locking password manager would suffice. Someone that should be concerned with passwords in-memory is someone who believes another has full physical access to their computer (and can, say, freeze RAM in nitrogen to extract passwords My largest concern would be an adversary snatching my phone while my password manager was actively opened
      - necovek 2y ago
        Locking a password manager and your computer is certainly good enough in many cases. But gaining access to memory might not need the sophistication of using nitrogen (see eg https://en.m.wikipedia.org/wiki/DMA_attack https://en.m.wikipedia.org/wiki/DMA_attack).

unethical_ban 2y ago

The one password and the app that uses it are more secure than most other applications. Lock out is just another term for DDoS if a bad actor knows usernames. I love proton pass.

wruza 2y ago

My bitwarden plugin locks out after a few minutes of inactivity. New installations are protected by totp. So one has to physically be at one of my devices few minutes after I leave even if they have a password. This reduces the attack source to a few people that I have to trust anyway. Also I can lock / logout manually if situation suggests. Or not log in at all and instead type the password from my phone screen. I understand the conceptual risk of storing everything behind a single “door”. That’s not ideal. But in practice, circumstances force you to create passwords, expose passwords, reset passwords, so you cannot remember them all. You either write them down (where? how secure?) or resort to having only a few “that you usually use”. Password managers solve the “where? how secure?” part. They don’t solve security, they help you to not do stupid things under pressure.