3 ms·
He's not wrong. I use a password manager that stores passwords only locally, not in the cloud. I can generate arbitrarily complex passwords and never have to wo
by bradley13 2y ago
He's not wrong. I use a password manager that stores passwords only locally, not in the cloud. I can generate arbitrarily complex passwords and never have to worry about how hard they are to type or remember.
2FA makes my workflow significantly more difficult. As a result, for non-critical sites, I have started allowing the browser to store my passwords, thus relying on the 2FA-authenticator for security. This result is likely less secure overall, since the browser's password storage could realistically be compromised.
That said, I do have to acknowledge the point in another comment that phishing may be the bigger threat. Log into a fake site with a password but no 2FA, and you are toast.
- postalrat 2y agoWhat is the difference between a secure password synced with a password manager and a cookie that doesn't expire synced with a browser or extension? I don't see much difference so why bother even having a password?
- megous 2y agoThe difference is that cookies are not even encrypted and you can get all of them by `sqlite3 .dump` on `cookies.sqlite` file, while password manager likely offers more protection, since that's the point of it. :D Also SID are ephemeral and expire, while passwords are not supposed to be. Session IDs may be tied by the backend to a client IP address, or some such, but likely that's not done very often, and may not be that useful.
- postalrat 2y agoIn this case the cookie would be as permanent as a password. I was just thinking if convenience is a priority why even have a password when the cookie is just as secure.
- 9dev 2y agoWhat if your cookie is compromised and you want to ensure the attacker cannot log into your account anymore?
- postalrat 2y agoUse your cookie to create a new cookie. Same as a password.