5 ms·

What a sane idea to store all your secrets in one place.... for attackers to get ahold of them in one move.

wps 8mo ago
Why does the federal reserve keep all that gold in one place? It’s far better to have a ridiculously secure store than it is to have to reuse passwords across a hundred sites (nobody here can remember a hundred unique high entropy passwords). I trust the cryptography far more than my brain to handle these things.
- lofaszvanitt 8mo ago
  Your argument is flawed. And you know it. For a starter, one gold bar there is around 12.5 kgs.
  - wps 8mo ago
    It doesn’t perfectly map, but it gets a visual point across. I cannot be convinced that it’s better for the average person to maintain a couple permutations of a primary password for a hundred different sites than it is for them to store it in a vetted and audited password manager. Even with the vulnerabilities mentioned in the paper you are far better off with a password manager and thus 100 fully unique passwords then without.
    - lofaszvanitt 8mo ago
      Yeah, but if you use the shack once per year, then why put the shack key amongst the ones you frequently use?
burnt-resistor 8mo ago
Educate us how then many unique secrets "should" be managed.
- lofaszvanitt 8mo ago
  Not in one "basket".
  - array_key_first 8mo ago
    Why not? The thing is that your argument is just not compatible with real life. Humans are humans, they are absolutely not going to create unique and strong passwords for every service. What happens in actuality is that they create one or two okay passwords, then reuse them, which is 100,000x worse than using a password manager. The promise of a password manager is you get infinite perfect passwords. Perfectly long, perfectly unguessable. And then you can redirect your brain power to making one really, really good password you can remember. The benefits are plentiful. You don't have to worry about breaches. You're immune to dictionary attacks and brute forcing. And, it's much more convenient.
    - burnt-resistor 8mo ago
      It's unreasonable to argue with an unreasonable person, especially with behavior of refusal to engage anything more than a superficial Tweet. Hey, maybe they access a bevy of doves that know their names and have their passwords tied to their feet? Seems totally practical!
    - lofaszvanitt 8mo ago
      How many services really need good protection? A few. Bank, gov, some online shops. Where you have PII. Forums, discussion groups do not really need protection. Plus if you have proper 2fa, you can even have a pw like: meowmeowww

wps 8mo ago

Why does the federal reserve keep all that gold in one place? It’s far better to have a ridiculously secure store than it is to have to reuse passwords across a hundred sites (nobody here can remember a hundred unique high entropy passwords). I trust the cryptography far more than my brain to handle these things.

lofaszvanitt 8mo ago
Your argument is flawed. And you know it. For a starter, one gold bar there is around 12.5 kgs.
- wps 8mo ago
  It doesn’t perfectly map, but it gets a visual point across. I cannot be convinced that it’s better for the average person to maintain a couple permutations of a primary password for a hundred different sites than it is for them to store it in a vetted and audited password manager. Even with the vulnerabilities mentioned in the paper you are far better off with a password manager and thus 100 fully unique passwords then without.
  - lofaszvanitt 8mo ago
    Yeah, but if you use the shack once per year, then why put the shack key amongst the ones you frequently use?

burnt-resistor 8mo ago

Educate us how then many unique secrets "should" be managed.

lofaszvanitt 8mo ago
Not in one "basket".
- array_key_first 8mo ago
  Why not? The thing is that your argument is just not compatible with real life. Humans are humans, they are absolutely not going to create unique and strong passwords for every service. What happens in actuality is that they create one or two okay passwords, then reuse them, which is 100,000x worse than using a password manager. The promise of a password manager is you get infinite perfect passwords. Perfectly long, perfectly unguessable. And then you can redirect your brain power to making one really, really good password you can remember. The benefits are plentiful. You don't have to worry about breaches. You're immune to dictionary attacks and brute forcing. And, it's much more convenient.
  - burnt-resistor 8mo ago
    It's unreasonable to argue with an unreasonable person, especially with behavior of refusal to engage anything more than a superficial Tweet. Hey, maybe they access a bevy of doves that know their names and have their passwords tied to their feet? Seems totally practical!
  - lofaszvanitt 8mo ago
    How many services really need good protection? A few. Bank, gov, some online shops. Where you have PII. Forums, discussion groups do not really need protection. Plus if you have proper 2fa, you can even have a pw like: meowmeowww